Maxim Levitsky 3dc5666baf KVM: nSVM: always intercept VMLOAD/VMSAVE when nested (CVE-2021-3656) ...

commit c7dfa40099 upstream.

If L1 disables VMLOAD/VMSAVE intercepts, and doesn't enable
Virtual VMLOAD/VMSAVE (currently not supported for the nested hypervisor),
then VMLOAD/VMSAVE must operate on the L1 physical memory, which is only
possible by making L0 intercept these instructions.

Failure to do so allowed the nested guest to run VMLOAD/VMSAVE unintercepted,
and thus read/write portions of the host physical memory.

Fixes: 89c8a4984f ("KVM: SVM: Enable Virtual VMLOAD VMSAVE feature")

Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2021-08-18 08:59:18 +02:00

..

alpha

alpha: Send stop IPI to send to online CPUs

2021-08-12 13:22:20 +02:00

arc

ARC: fp: set FPU_STATUS.FWE to enable FPU_STATUS update on context switch

2021-08-18 08:59:06 +02:00

arm

ARM: omap2+: hwmod: fix potential NULL pointer access

2021-08-12 13:22:17 +02:00

arm64

arm64: dts: renesas: beacon: Fix USB ref clock references

2021-08-15 14:00:25 +02:00

c6x

Merge tag 'arch-cleanup-2020-10-22' of git://git.kernel.dk/linux-block

2020-10-23 10:06:38 -07:00

csky

csky: syscache: Fixup duplicate cache flush

2021-07-14 16:56:52 +02:00

h8300

h8300: fix PREEMPTION build, TI_PRE_COUNT undefined

2021-02-17 11:02:28 +01:00

hexagon

hexagon: use common DISCARDS macro

2021-07-20 16:05:53 +02:00

ia64

mm/page_alloc: fix memory map initialization for descending nodes

2021-07-25 14:36:18 +02:00

m68k

m68k: atari: Fix ATARI_KBD_CORE kconfig unmet dependency warning

2021-07-14 16:56:05 +02:00

microblaze

local64.h: make <asm/local64.h> mandatory

2021-01-12 20:18:16 +01:00

mips

MIPS: Malta: Do not byte-swap accesses to the CBUS UART

2021-08-12 13:22:15 +02:00

nds32

nds32: fix up stack guard gap

2021-07-28 14:35:46 +02:00

nios2

nios2: fixed broken sys_clone syscall

2021-03-04 11:38:16 +01:00

openrisc

sched/core: Initialize the idle task with preemption disabled

2021-07-14 16:55:50 +02:00

parisc

sched/core: Initialize the idle task with preemption disabled

2021-07-14 16:55:50 +02:00

powerpc

powerpc/smp: Fix OOPS in topology_init()

2021-08-18 08:59:17 +02:00

riscv

bpf: Introduce BPF nospec instruction for mitigating Spectre v4

2021-08-04 12:46:44 +02:00

s390

bpf: Introduce BPF nospec instruction for mitigating Spectre v4

2021-08-04 12:46:44 +02:00

sh

sched/core: Initialize the idle task with preemption disabled

2021-07-14 16:55:50 +02:00

sparc

bpf: Introduce BPF nospec instruction for mitigating Spectre v4

2021-08-04 12:46:44 +02:00

um

um: fix error return code in winch_tramp()

2021-07-20 16:05:51 +02:00

x86

KVM: nSVM: always intercept VMLOAD/VMSAVE when nested (CVE-2021-3656)

2021-08-18 08:59:18 +02:00

xtensa

sched/core: Initialize the idle task with preemption disabled

2021-07-14 16:55:50 +02:00

.gitignore

…

Kconfig

fanotify: Fix sys_fanotify_mark() on native x86-32

2021-01-17 14:16:59 +01:00