diff options
| author | Jim Mattson <jmattson@google.com> | 2017-09-12 13:02:54 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2017-10-05 09:35:52 +0200 |
| commit | 6ad74630c016ef823f2720671ee4db641d35fd2c (patch) | |
| tree | 2f63061d08fc0291154ed7d4710ec34aeeb702fe /net/lapb/lapb_timer.c | |
| parent | 6528968794bc6b4091a7603ae863472c1ef7c393 (diff) | |
kvm: nVMX: Don't allow L2 to access the hardware CR8
commit 51aa68e7d57e3217192d88ce90fd5b8ef29ec94f upstream.
If L1 does not specify the "use TPR shadow" VM-execution control in
vmcs12, then L0 must specify the "CR8-load exiting" and "CR8-store
exiting" VM-execution controls in vmcs02. Failure to do so will give
the L2 VM unrestricted read/write access to the hardware CR8.
This fixes CVE-2017-12154.
Signed-off-by: Jim Mattson <jmattson@google.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net/lapb/lapb_timer.c')
0 files changed, 0 insertions, 0 deletions