• Nadav Amit's avatar
    KVM: x86: Handle errors when RIP is set during far jumps · d1442d85
    Nadav Amit authored
    Far jmp/call/ret may fault while loading a new RIP.  Currently KVM does not
    handle this case, and may result in failed vm-entry once the assignment is
    done.  The tricky part of doing so is that loading the new CS affects the
    VMCS/VMCB state, so if we fail during loading the new RIP, we are left in
    unconsistent state.  Therefore, this patch saves on 64-bit the old CS
    descriptor and restores it if loading RIP failed.
    
    This fixes CVE-2014-3647.
    
    Cc: stable@vger.kernel.org
    Signed-off-by: default avatarNadav Amit <namit@cs.technion.ac.il>
    Signed-off-by: default avatarPaolo Bonzini <pbonzini@redhat.com>
    d1442d85
emulate.c 129 KB