• Andy Honig's avatar
    KVM: x86: Fix potential divide by 0 in lapic (CVE-2013-6367) · b963a22e
    Andy Honig authored
    Under guest controllable circumstances apic_get_tmcct will execute a
    divide by zero and cause a crash.  If the guest cpuid support
    tsc deadline timers and performs the following sequence of requests
    the host will crash.
    - Set the mode to periodic
    - Set the TMICT to 0
    - Set the mode bits to 11 (neither periodic, nor one shot, nor tsc deadline)
    - Set the TMICT to non-zero.
    Then the lapic_timer.period will be 0, but the TMICT will not be.  If the
    guest then reads from the TMCCT then the host will perform a divide by 0.
    
    This patch ensures that if the lapic_timer.period is 0, then the division
    does not occur.
    Reported-by: default avatarAndrew Honig <ahonig@google.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: default avatarAndrew Honig <ahonig@google.com>
    Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
    b963a22e
lapic.c 46.2 KB