qemu-devel
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Qemu-devel] [BUG] user-to-root privesc inside VM via bad translatio


From: Richard Henderson
Subject: Re: [Qemu-devel] [BUG] user-to-root privesc inside VM via bad translation caching
Date: Thu, 23 Mar 2017 06:01:17 +1000
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.8.0

On 03/23/2017 02:29 AM, Pranith Kumar wrote:
On Wed, Mar 22, 2017 at 11:21 AM, Peter Maydell
<address@hidden> wrote:
On 22 March 2017 at 15:14, Pranith Kumar <address@hidden> wrote:
On Wed, Mar 22, 2017 at 11:04 AM, Peter Maydell
<address@hidden> wrote:
This doesn't look right because it means we'll check
only after we've emitted all the code to do the
instruction operation, so the effect will be
"execute instruction, then take illegal-opcode
exception".

The pc is restored to original address (s->pc = pc_start), so the
exception will overwrite the generated illegal instruction and will be
executed first.

s->pc is the guest PC -- moving that backwards will
not do anything about the generated TCG IR that's
already been written. You'd need to rewind the
write pointer in the IR stream, which there is
no support for doing AFAIK.

Ah, OK. Thanks for the explanation. May be we should check the size of
the instruction while decoding the prefixes and error out once we
exceed the limit. We would not generate any IR code.

Yes.

It would not enforce a true limit of 15 bytes, since you can't know that until you've done the rest of the decode. But you'd be able to say that no more than 14 prefix + 1 opc + 6 modrm+sib+ofs + 4 immediate = 25 bytes is used.

Which does fix the bug.


r~



reply via email to

[Prev in Thread] Current Thread [Next in Thread]