KVM: nSVM: always intercept VMLOAD/VMSAVE when nested (CVE-2021-3656)

Maxim Levitsky · gregkh · commit 3dc5666baf2a · 2021-08-18T08:59:18.000+02:00
commit c7dfa40 upstream. If L1 disables VMLOAD/VMSAVE intercepts, and doesn't enable Virtual VMLOAD/VMSAVE (currently not supported for the nested hypervisor), then VMLOAD/VMSAVE must operate on the L1 physical memory, which is only possible by making L0 intercept these instructions. Failure to do so allowed the nested guest to run VMLOAD/VMSAVE unintercepted, and thus read/write portions of the host physical memory. Fixes: 89c8a49 ("KVM: SVM: Enable Virtual VMLOAD VMSAVE feature") Suggested-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Maxim Levitsky <mlevitsk@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
diff --git a/arch/x86/kvm/svm/nested.c b/arch/x86/kvm/svm/nested.c
@@ -147,6 +147,9 @@ void recalc_intercepts(struct vcpu_svm *svm)
 
 	for (i = 0; i < MAX_INTERCEPT; i++)
 		c->intercepts[i] |= g->intercepts[i];
+
+	vmcb_set_intercept(c, INTERCEPT_VMLOAD);
+	vmcb_set_intercept(c, INTERCEPT_VMSAVE);
 }
 
 static void copy_vmcb_control_area(struct vmcb_control_area *dst,

Original file line number	Diff line number	Diff line change
`@@ -147,6 +147,9 @@ void recalc_intercepts(struct vcpu_svm *svm)`
`147`	`147`
`148`	`148`	`for (i = 0; i < MAX_INTERCEPT; i++)`
`149`	`149`	`c->intercepts[i] \|= g->intercepts[i];`
	`150`	`+`
	`151`	`+ vmcb_set_intercept(c, INTERCEPT_VMLOAD);`
	`152`	`+ vmcb_set_intercept(c, INTERCEPT_VMSAVE);`
`150`	`153`	`}`
`151`	`154`
`152`	`155`	`static void copy_vmcb_control_area(struct vmcb_control_area *dst,`