Provide some mitigation against CVE-2017-5715 by clearing registers
upon returning from the guest which aren't immediately clobbered by the host. This eradicates any remaining guest contents limiting their usefulness in an exploit gadget. This was inspired by this linux commit: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5b6c02f38315b720c593c6079364855d276886aa Reviewed by: grehan, rgrimes Sponsored by: Dell EMC Isilon Differential Revision: https://reviews.freebsd.org/D13573
This commit is contained in:
parent
a7264ff541
commit
91fe5fe7e7
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=328011
@ -124,9 +124,21 @@ ENTRY(svm_launch)
|
||||
pop %rdx
|
||||
mov %edx, %eax
|
||||
shr $32, %rdx
|
||||
mov $MSR_GSBASE, %ecx
|
||||
mov $MSR_GSBASE, %rcx
|
||||
wrmsr
|
||||
|
||||
/*
|
||||
* Clobber the remaining registers with guest contents so they
|
||||
* can't be misused.
|
||||
*/
|
||||
xor %rbp, %rbp
|
||||
xor %rdi, %rdi
|
||||
xor %rsi, %rsi
|
||||
xor %r8, %r8
|
||||
xor %r9, %r9
|
||||
xor %r10, %r10
|
||||
xor %r11, %r11
|
||||
|
||||
VLEAVE
|
||||
ret
|
||||
END(svm_launch)
|
||||
|
@ -71,6 +71,20 @@
|
||||
movq VMXCTX_GUEST_R15(%rdi),%r15; \
|
||||
movq VMXCTX_GUEST_RDI(%rdi),%rdi; /* restore rdi the last */
|
||||
|
||||
/*
|
||||
* Clobber the remaining registers with guest contents so they can't
|
||||
* be misused.
|
||||
*/
|
||||
#define VMX_GUEST_CLOBBER \
|
||||
xor %rax, %rax; \
|
||||
xor %rcx, %rcx; \
|
||||
xor %rdx, %rdx; \
|
||||
xor %rsi, %rsi; \
|
||||
xor %r8, %r8; \
|
||||
xor %r9, %r9; \
|
||||
xor %r10, %r10; \
|
||||
xor %r11, %r11;
|
||||
|
||||
/*
|
||||
* Save and restore the host context.
|
||||
*
|
||||
@ -232,6 +246,8 @@ vmx_exit_guest:
|
||||
|
||||
VMX_HOST_RESTORE
|
||||
|
||||
VMX_GUEST_CLOBBER
|
||||
|
||||
/*
|
||||
* This will return to the caller of 'vmx_enter_guest()' with a return
|
||||
* value of VMX_GUEST_VMEXIT.
|
||||
|
Loading…
Reference in New Issue
Block a user