From d59eef237d3e6b9f97e9b9b13544b14210ca1409 Mon Sep 17 00:00:00 2001 From: Wolfgang Bumiller Date: Thu, 14 Apr 2016 15:17:21 +0200 Subject: [PATCH] Fix 'i386: leakage of stack memory to guest in kvmvapic.c' --- ...6-kvmvapic-initialise-imm32-variable.patch | 32 +++++++++++++++++++ debian/patches/series | 1 + 2 files changed, 33 insertions(+) create mode 100644 debian/patches/extra/0001-i386-kvmvapic-initialise-imm32-variable.patch diff --git a/debian/patches/extra/0001-i386-kvmvapic-initialise-imm32-variable.patch b/debian/patches/extra/0001-i386-kvmvapic-initialise-imm32-variable.patch new file mode 100644 index 0000000..30dd40e --- /dev/null +++ b/debian/patches/extra/0001-i386-kvmvapic-initialise-imm32-variable.patch @@ -0,0 +1,32 @@ +From 45fcb0d1c15d7be4915404cd0e6e1ce380e6cd1f Mon Sep 17 00:00:00 2001 +From: Prasad J Pandit +Date: Thu, 7 Apr 2016 12:50:08 +0530 +Subject: [PATCH] i386: kvmvapic: initialise imm32 variable + +When processing Task Priorty Register(TPR) access, it could leak +automatic stack variable 'imm32' in patch_instruction(). +Initialise the variable to avoid it. + +Reported by: Donghai Zdh + +Signed-off-by: Prasad J Pandit +--- + hw/i386/kvmvapic.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/hw/i386/kvmvapic.c b/hw/i386/kvmvapic.c +index f0922da..97f3646 100644 +--- a/hw/i386/kvmvapic.c ++++ b/hw/i386/kvmvapic.c +@@ -393,7 +393,7 @@ static void patch_instruction(VAPICROMState *s, X86CPU *cpu, target_ulong ip) + CPUX86State *env = &cpu->env; + VAPICHandlers *handlers; + uint8_t opcode[2]; +- uint32_t imm32; ++ uint32_t imm32 = 0; + target_ulong current_pc = 0; + target_ulong current_cs_base = 0; + int current_flags = 0; +-- +2.1.4 + diff --git a/debian/patches/series b/debian/patches/series index ecb8ad4..806692e 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -52,3 +52,4 @@ extra/0003-rng-move-request-queue-cleanup-from-RngEgd-to-RngBac.patch extra/CVE-2016-2858-0004-rng-add-request-queue-support-to-rng-random.patch extra/0005-virtio-rng-ask-for-more-data-if-queue-is-not-fully-d.patch extra/0001-target-i386-do-not-read-write-MSR_TSC_AUX-from-KVM-i.patch +extra/0001-i386-kvmvapic-initialise-imm32-variable.patch -- 2.39.2