From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755808AbdESKdX (ORCPT ); Fri, 19 May 2017 06:33:23 -0400 Received: from mail-wm0-f66.google.com ([74.125.82.66]:33813 "EHLO mail-wm0-f66.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751551AbdESKdS (ORCPT ); Fri, 19 May 2017 06:33:18 -0400 Subject: Re: [PATCH] KVM: X86: Fix read out-of-bounds vulnerability in kvm pio emulation To: Wanpeng Li , linux-kernel@vger.kernel.org, kvm@vger.kernel.org Cc: =?UTF-8?B?UmFkaW0gS3LEjW3DocWZ?= , Wanpeng Li , Moguofang References: <1495187216-9294-1-git-send-email-wanpeng.li@hotmail.com> From: Paolo Bonzini Message-ID: Date: Fri, 19 May 2017 12:33:13 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.1.0 MIME-Version: 1.0 In-Reply-To: <1495187216-9294-1-git-send-email-wanpeng.li@hotmail.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 19/05/2017 11:46, Wanpeng Li wrote: > From: Wanpeng Li > > Huawei folks reported a read out-of-bounds vulnerability in kvm pio emulation. > > - "inb" instruction to access PIT Mod/Command register (ioport 0x43, write only, > a read should be ignored) in guest can get a random number. > - "rep insb" instruction to access PIT register port 0x43 can control memcpy() > in emulator_pio_in_emulated() to copy max 0x400 bytes but only read 1 bytes, > which will disclose the unimportant kernel memory in host but no crash. The data comes simply from the last PIO read, right? The vcpu struct is zero-initialized, so there is no kernel memory leak---the byte was already previously known to the guest. Good catch though, and the patch looks good. Thanks, Paolo > The similar test program below can reproduce the read out-of-bounds vulnerability: