In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor<\/p>\n
ZCR_EL2 can be updated by a VHE guest hypervisor either using ZCR_EL2
\n(which traps) or ZCR_EL1 (which does not trap). KVM handles both in
\ndifferent way:<\/p>\n
– on ZCR_EL2 trap, ZCR_EL2.LEN is immediately capped at the VM’s own
\n VL limit. This has the potential to break existing SW that relies
\n on the full LEN field to be stateful.<\/p>\n
– on ZCR_EL1 access, we do absolutely nothing.<\/p>\n
On restoring the SVE context for an L2 guest, we directly restore the
\nguest hypervisor’s view of ZCR_EL2 into the physical ZCR_EL2. If the
\nguest’s view of the register was updated using the ZCR_EL2 accessor,
\nthe value has already been sanitised (with the caveat mentioned above).<\/p>\n
But if the guest used ZCR_EL1, the raw value is written into the HW,
\nand the L2 guest can now access VLs that it shouldn’t.<\/p>\n
Fix all the above by moving the VL capping to the restore points,
\nensuring that:<\/p>\n
– the HW is always programmed with a capped value, irrespective of
\n the accessor being used,<\/p>\n
– the ZCR_EL2.LEN field is always completely stateful, irrespective
\n of the accessor being used.<\/p>\n
Additionally, move ZCR_EL2 to be a sanitised register, ensuring that
\nonly the LEN field is actually stateful. This requires some creative
\nconstruction of the RES0 mask, as the sysreg generation script does
\nnot yet generate RAZ\/WI fields.<\/p>\n
[maz: rewrote commit message, tidy up access_zcr_el2()]<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
KVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor<\/p>\n
ZCR_EL2 can be updated by a VHE guest hypervisor either using ZCR<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-14971","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/14971","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14971"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14971"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14971"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}