i386/tdx: Fix the UAF issue in tdx_fetch_cpuid()

[PATCH] i386/tdx: Fix the UAF issue in tdx_fetch_cpuid()

Posted by Xiaoyao Li 1 week, 3 days ago

Fix the UAF issue by reading the returned size before freeing the
fetch_cpuid structure.

Link: https://lore.kernel.org/r/758d7f2c-938f-49cb-89fc-980fc8e020b2@weilnetz.de
Reported-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
---
 target/i386/kvm/tdx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
index 4cae99c281ac..e578110df4da 100644
--- a/target/i386/kvm/tdx.c
+++ b/target/i386/kvm/tdx.c
@@ -847,8 +847,8 @@ static struct kvm_cpuid2 *tdx_fetch_cpuid(CPUState *cpu, int *ret)
         fetch_cpuid->nent = size;
         r = tdx_vcpu_ioctl(cpu, KVM_TDX_GET_CPUID, 0, fetch_cpuid, &local_err);
         if (r == -E2BIG) {
-            g_free(fetch_cpuid);
             size = fetch_cpuid->nent;
+            g_free(fetch_cpuid);
         }
     } while (r == -E2BIG);
 
-- 
2.43.0

Re: [PATCH] i386/tdx: Fix the UAF issue in tdx_fetch_cpuid()

Posted by Philippe Mathieu-Daudé 1 week, 3 days ago

On 24/3/26 02:23, Xiaoyao Li wrote:
> Fix the UAF issue by reading the returned size before freeing the
> fetch_cpuid structure.
> 
> Link: https://lore.kernel.org/r/758d7f2c-938f-49cb-89fc-980fc8e020b2@weilnetz.de

Fixes: e3d1a4a6d1d ("i386/tdx: Fetch and validate CPUID of TD guest")

> Reported-by: Stefan Weil <sw@weilnetz.de>
> Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
> ---
>   target/i386/kvm/tdx.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
> index 4cae99c281ac..e578110df4da 100644
> --- a/target/i386/kvm/tdx.c
> +++ b/target/i386/kvm/tdx.c
> @@ -847,8 +847,8 @@ static struct kvm_cpuid2 *tdx_fetch_cpuid(CPUState *cpu, int *ret)
>           fetch_cpuid->nent = size;
>           r = tdx_vcpu_ioctl(cpu, KVM_TDX_GET_CPUID, 0, fetch_cpuid, &local_err);
>           if (r == -E2BIG) {
> -            g_free(fetch_cpuid);
>               size = fetch_cpuid->nent;
> +            g_free(fetch_cpuid);
>           }
>       } while (r == -E2BIG);
>

Re: [PATCH] i386/tdx: Fix the UAF issue in tdx_fetch_cpuid()

Posted by Xiaoyao Li 1 week, 3 days ago

On 3/24/2026 1:35 PM, Philippe Mathieu-Daudé wrote:
> On 24/3/26 02:23, Xiaoyao Li wrote:
>> Fix the UAF issue by reading the returned size before freeing the
>> fetch_cpuid structure.
>>
>> Link: https://lore.kernel.org/ 
>> r/758d7f2c-938f-49cb-89fc-980fc8e020b2@weilnetz.de
> 
> Fixes: e3d1a4a6d1d ("i386/tdx: Fetch and validate CPUID of TD guest")

Oh, I missed this.

Thanks for providing it!

>> Reported-by: Stefan Weil <sw@weilnetz.de>
>> Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
>> ---
>>   target/i386/kvm/tdx.c | 2 +-
>>   1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/target/i386/kvm/tdx.c b/target/i386/kvm/tdx.c
>> index 4cae99c281ac..e578110df4da 100644
>> --- a/target/i386/kvm/tdx.c
>> +++ b/target/i386/kvm/tdx.c
>> @@ -847,8 +847,8 @@ static struct kvm_cpuid2 *tdx_fetch_cpuid(CPUState 
>> *cpu, int *ret)
>>           fetch_cpuid->nent = size;
>>           r = tdx_vcpu_ioctl(cpu, KVM_TDX_GET_CPUID, 0, fetch_cpuid, 
>> &local_err);
>>           if (r == -E2BIG) {
>> -            g_free(fetch_cpuid);
>>               size = fetch_cpuid->nent;
>> +            g_free(fetch_cpuid);
>>           }
>>       } while (r == -E2BIG);
>