patches/kernel/0009-UBUNTU-SAUCE-KVM-nSVM-always-intercept-VMLOAD-VMSAVE.patch

   1 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
   2 From: Maxim Levitsky <mlevitsk@redhat.com>
   3 Date: Thu, 29 Jul 2021 18:37:38 +0300
   4 Subject: [PATCH] UBUNTU: SAUCE: KVM: nSVM: always intercept VMLOAD/VMSAVE when
   5  nested
   6
   7 If L1 disables VMLOAD/VMSAVE intercepts, and doesn't enable
   8 Virtual VMLOAD/VMSAVE (currently not supported for the nested hypervisor),
   9 then VMLOAD/VMSAVE must operate on the L1 physical memory, which is only
  10 possible by making L0 intercept these instructions.
  11
  12 Failure to do so allowed the nested guest to run VMLOAD/VMSAVE unintercepted,
  13 and thus read/write portions of the host physical memory.
  14
  15 This fixes CVE-2021-3656, which was discovered by Maxim Levitsky and
  16 Paolo Bonzini.
  17
  18 Fixes: 89c8a4984fc9 ("KVM: SVM: Enable Virtual VMLOAD VMSAVE feature")
  19 Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com>
  20 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
  21 CVE-2021-3656
  22 Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
  23 Acked-by: Stefan Bader <stefan.bader@canonical.com>
  24 Acked-by: Ben Romer <benjamin.romer@canonical.com>
  25 Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
  26 (cherry picked from commit 7e23c00e809c1669676363962e2ef9df1bd2840b)
  27 Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
  28 ---
  29  arch/x86/kvm/svm/nested.c | 3 +++
  30  1 file changed, 3 insertions(+)
  31
  32 diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
  33 index 049d3cbbee5a..3bd5c7d6716e 100644
  34 --- a/arch/x86/kvm/svm/nested.c
  35 +++ b/arch/x86/kvm/svm/nested.c
  36 @@ -147,6 +147,9 @@ void recalc_intercepts(struct vcpu_svm *svm)
  37
  38         for (i = 0; i < MAX_INTERCEPT; i++)
  39                 c->intercepts[i] |= g->intercepts[i];
  40 +
  41 +       vmcb_set_intercept(c, INTERCEPT_VMLOAD);
  42 +       vmcb_set_intercept(c, INTERCEPT_VMSAVE);
  43  }
  44
  45  static void copy_vmcb_control_area(struct vmcb_control_area *dst,