[prev in list] [next in list] [prev in thread] [next in thread] 

List:       xen-cvs
Subject:    [Xen-changelog] [xen stable-4.1] x86/HVM: only allow ring 0 guest code to make hypercalls
From:       patchbot () xen ! org
Date:       2013-11-28 8:11:13
Message-ID: E1Vlwgr-00044K-3c () xenbits ! xen ! org
[Download RAW message or body]

commit 21c17c15931f1dcb3da5520d8d542e973098297d
Author:     Jan Beulich <jbeulich@suse.com>
AuthorDate: Wed Nov 27 09:52:08 2013 +0100
Commit:     Jan Beulich <jbeulich@suse.com>
CommitDate: Wed Nov 27 09:52:08 2013 +0100

    x86/HVM: only allow ring 0 guest code to make hypercalls
    
    Anything else would allow for privilege escalation.
    
    This is CVE-2013-4554 / XSA-76.
    
    Signed-off-by: Jan Beulich <jbeulich@suse.com>
    Acked-by: Ian Campbell <ian.campbell@citrix.com>
    master commit: 5c447caaf49192c7b2c057ffbb565ce72aac666d
    master date: 2013-11-27 09:01:49 +0100
---
 xen/arch/x86/hvm/hvm.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/xen/arch/x86/hvm/hvm.c b/xen/arch/x86/hvm/hvm.c
index dc24810..9a0a91e 100644
--- a/xen/arch/x86/hvm/hvm.c
+++ b/xen/arch/x86/hvm/hvm.c
@@ -2828,7 +2828,7 @@ int hvm_do_hypercall(struct cpu_user_regs *regs)
     case 4:
     case 2:
         hvm_get_segment_register(curr, x86_seg_ss, &sreg);
-        if ( unlikely(sreg.attr.fields.dpl == 3) )
+        if ( unlikely(sreg.attr.fields.dpl) )
         {
     default:
             regs->eax = -EPERM;
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.1

_______________________________________________
Xen-changelog mailing list
Xen-changelog@lists.xen.org
http://lists.xensource.com/xen-changelog
[prev in list] [next in list] [prev in thread] [next in thread]