aboutsummaryrefslogtreecommitdiff
path: root/virt
diff options
context:
space:
mode:
authorAndy Honig <ahonig@google.com>2013-02-20 14:48:10 -0800
committerMarcelo Tosatti <mtosatti@redhat.com>2013-03-19 14:17:35 -0300
commit0b79459b482e85cb7426aa7da683a9f2c97aeae1 (patch)
tree05c654b29280a76ed3ce2297825d111b956b7a64 /virt
parentc300aa64ddf57d9c5d9c898a64b36877345dd4a9 (diff)
downloadvexpress-lsk-0b79459b482e85cb7426aa7da683a9f2c97aeae1.tar.gz
KVM: x86: Convert MSR_KVM_SYSTEM_TIME to use gfn_to_hva_cache functions (CVE-2013-1797)
There is a potential use after free issue with the handling of MSR_KVM_SYSTEM_TIME. If the guest specifies a GPA in a movable or removable memory such as frame buffers then KVM might continue to write to that address even after it's removed via KVM_SET_USER_MEMORY_REGION. KVM pins the page in memory so it's unlikely to cause an issue, but if the user space component re-purposes the memory previously used for the guest, then the guest will be able to corrupt that memory. Tested: Tested against kvmclock unit test Signed-off-by: Andrew Honig <ahonig@google.com> Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
Diffstat (limited to 'virt')
0 files changed, 0 insertions, 0 deletions