[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [BUG] user-to-root privesc inside VM via bad translatio
From: |
Paolo Bonzini |
Subject: |
Re: [Qemu-devel] [BUG] user-to-root privesc inside VM via bad translation caching |
Date: |
Thu, 23 Mar 2017 11:27:38 +0100 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.7.0 |
On 22/03/2017 21:01, Richard Henderson wrote:
>>
>> Ah, OK. Thanks for the explanation. May be we should check the size of
>> the instruction while decoding the prefixes and error out once we
>> exceed the limit. We would not generate any IR code.
>
> Yes.
>
> It would not enforce a true limit of 15 bytes, since you can't know that
> until you've done the rest of the decode. But you'd be able to say that
> no more than 14 prefix + 1 opc + 6 modrm+sib+ofs + 4 immediate = 25
> bytes is used.
>
> Which does fix the bug.
Yeah, that would work for 2.9 if somebody wants to put together a patch.
Ensuring that all instruction fetching happens before translation side
effects is a little harder, but perhaps it's also the opportunity to get
rid of s->rip_offset which is a little ugly.
Paolo
- [Qemu-devel] [BUG] user-to-root privesc inside VM via bad translation caching, Jann Horn, 2017/03/20
- Re: [Qemu-devel] [BUG] user-to-root privesc inside VM via bad translation caching, Peter Maydell, 2017/03/20
- Re: [Qemu-devel] [BUG] user-to-root privesc inside VM via bad translation caching, Pranith Kumar, 2017/03/22
- Re: [Qemu-devel] [BUG] user-to-root privesc inside VM via bad translation caching, Peter Maydell, 2017/03/22
- Re: [Qemu-devel] [BUG] user-to-root privesc inside VM via bad translation caching, Pranith Kumar, 2017/03/22
- Re: [Qemu-devel] [BUG] user-to-root privesc inside VM via bad translation caching, Peter Maydell, 2017/03/22
- Re: [Qemu-devel] [BUG] user-to-root privesc inside VM via bad translation caching, Pranith Kumar, 2017/03/22
- Re: [Qemu-devel] [BUG] user-to-root privesc inside VM via bad translation caching, Richard Henderson, 2017/03/22
- Re: [Qemu-devel] [BUG] user-to-root privesc inside VM via bad translation caching,
Paolo Bonzini <=
- Re: [Qemu-devel] [BUG] user-to-root privesc inside VM via bad translation caching, Pranith Kumar, 2017/03/23
- Re: [Qemu-devel] [BUG] user-to-root privesc inside VM via bad translation caching, Paolo Bonzini, 2017/03/23
- Re: [Qemu-devel] [BUG] user-to-root privesc inside VM via bad translation caching, Pranith Kumar, 2017/03/23