From 6791ab169fe6b2cd7c69a5140cd229d036e706b0 Mon Sep 17 00:00:00 2001 From: Jan Beulich Date: Tue, 18 Nov 2014 14:32:57 +0100 Subject: [PATCH] x86: don't allow page table updates on non-PV page tables in do_mmu_update() paging_write_guest_entry() and paging_cmpxchg_guest_entry() aren't consistently supported for non-PV guests (they'd deref NULL for PVH or non-HAP HVM ones). Don't allow respective MMU_* operations on the page tables of such domains. This is CVE-2014-8594 / XSA-109. Signed-off-by: Jan Beulich Acked-by: Tim Deegan --- xen/arch/x86/mm.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/xen/arch/x86/mm.c b/xen/arch/x86/mm.c index 9ec617b110..121aef4bbd 100644 --- a/xen/arch/x86/mm.c +++ b/xen/arch/x86/mm.c @@ -3794,6 +3794,10 @@ long do_mmu_update( { p2m_type_t p2mt; + rc = -EOPNOTSUPP; + if ( unlikely(paging_mode_refcounts(pt_owner)) ) + break; + rc = xsm_mmu_normal_update(d, pt_owner, pg_owner, req.val); if ( rc ) break; -- 2.39.5