In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()<\/p>\n
Drop a BUG_ON() that has been reachable since it was first added, way back
\nin 2009, and instead use get_unaligned() to perform potentially-unaligned
\naccesses.<\/p>\n
For a given store, KVM x86’s emulator tracks the entire value in the
\ndestination operand, x86_emulate_ctxt.dst. If the destination is memory,
\nand the target splits multiple pages and\/or is emulated MMIO, then KVM
\nhandles each fragment independently. E.g. on a page split starting at page
\noffset 0xffc, KVM writes 4 bytes to the first page, then the remaining
\nbytes to the second page, using ctxt->dst as the source for both (with
\nappropriate offsets).<\/p>\n
If the destination splits a page *and* hits emulated MMIO on the second
\npage, then KVM will complete the write to the first page, then emulate the
\nMMIO access to the second page. If there is a datamatch-enabled ioeventfd
\nat offset 0 of the second page, then KVM will process the remainder of the
\nstore as a potential ioeventfd signal.<\/p>\n
Putting it all together, if the guest emits a store that splits a page
\nstarting at page offset N, and the second page has a datamatch-enabled
\nioeventfd at offset 0, then KVM will check for datamatch using
\n&dst.valptr[N] as the source. Due to dst (and thus dst.valptr) being
\n32-byte aligned, if N is not aligned to @len, the BUG_ON() fires.<\/p>\n
E.g. with a 16-byte store at page offset 0xffc, to an ioeventfd of len 8,
\nall initial checks in ioeventfd_in_range() will succeed, and the BUG_ON()
\nfires due to @val being 4-byte aligned, but not 8-byte aligned.<\/p>\n
————[ cut here ]————
\n kernel BUG at arch\/x86\/kvm\/..\/..\/..\/virt\/kvm\/eventfd.c:783!
\n Oops: invalid opcode: 0000 [#1] SMP
\n CPU: 0 UID: 1000 PID: 615 Comm: repro Not tainted 7.1.0-rc2-ff238429d1ea #365 PREEMPT
\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 0.0.0 02\/06\/2015
\n RIP: 0010:ioeventfd_write+0x6c\/0x70 [kvm]
\n Call Trace:<\/p>\n
__kvm_io_bus_write+0x85\/0xb0 [kvm]
\n kvm_io_bus_write+0x53\/0x80 [kvm]
\n vcpu_mmio_write+0x66\/0xf0 [kvm]
\n emulator_read_write_onepage+0x12a\/0x540 [kvm]
\n emulator_read_write+0x109\/0x2b0 [kvm]
\n x86_emulate_insn+0x4f8\/0xfb0 [kvm]
\n x86_emulate_instruction+0x181\/0x790 [kvm]
\n kvm_mmu_page_fault+0x313\/0x630 [kvm]
\n vmx_handle_exit+0x18a\/0x590 [kvm_intel]
\n kvm_arch_vcpu_ioctl_run+0xc81\/0x1c90 [kvm]
\n kvm_vcpu_ioctl+0x2d5\/0x970 [kvm]
\n __x64_sys_ioctl+0x8a\/0xd0
\n do_syscall_64+0xb7\/0x890
\n entry_SYSCALL_64_after_hwframe+0x4b\/0x53
\n RIP: 0033:0x7f19c931a9bf<\/p>\n
Modules linked in: kvm_intel kvm irqbypass
\n —[ end trace 0000000000000000 ]—<\/p>\n
In a perfect world, the fix would be to simply delete the BUG_ON(), as KVM
\nx86 doesn’t perform alignment checks on “normal” memory accesses at CPL0.
\nSadly, C99 ruins all the fun; while the x86 architecture plays nice,
\ndereferencing an unaligned pointer directly is undefined behavior in C,
\ne.g. triggers splats when running with CONFIG_UBSAN_ALIGNMENT=y.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()<\/p>\n
Drop a BUG_ON() that has been reachable since <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-14883","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/14883","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14883"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14883"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14883"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}