From nobody Sun May 5 01:08:15 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=pass(p=reject dis=none) header.from=citrix.com ARC-Seal: i=1; a=rsa-sha256; t=1612914078; cv=none; d=zohomail.com; s=zohoarc; b=QO5PlnFM/0t2CzaYOK6K3EFwq8kCgfs9YZTnf3D2OZ+vHAr5QGpnmgXV5vRddgxKho+06Ui/5kB1kgAVm6mngpaweihkTK6DC8r7acbUyhDyRxZYLBi+MYDcqD2XXbLcuoteSiG4aWe6giIC0n/pbk0VXsUnj0/8k/EuljxyZHI= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1612914078; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:To; bh=vPsSOC2vtnzsZjW70LgcxQzfstfPwzZ8zycWQmZQPOw=; b=fdJuVKbb0psTtP9P9hQ3TUrDVGmVTg+VAD42Qd5D7DRpL7mOqAzZdYPaWksIsquR6dKD58RUplhWxqtAy3YWTBQ+LY+SnWVjnbk6t616lJ3NfLC9y9w8LL+ysyEdtmh110+pduZE/AppULRbt+fz2XLC4HVibeqd/9B0f2sio2c= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=pass header.from= (p=reject dis=none) header.from= Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1612914078355332.06251947029045; Tue, 9 Feb 2021 15:41:18 -0800 (PST) Received: from list by lists.xenproject.org with outflank-mailman.83456.155380 (Exim 4.92) (envelope-from ) id 1l9cch-0007yW-VP; Tue, 09 Feb 2021 23:40:47 +0000 Received: by outflank-mailman (output) from mailman id 83456.155380; Tue, 09 Feb 2021 23:40:47 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1l9cch-0007yP-RY; Tue, 09 Feb 2021 23:40:47 +0000 Received: by outflank-mailman (input) for mailman id 83456; Tue, 09 Feb 2021 23:40:47 +0000 Received: from all-amaz-eas1.inumbo.com ([34.197.232.57] helo=us1-amaz-eas2.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1l9ccg-0007yG-LU for xen-devel@lists.xenproject.org; Tue, 09 Feb 2021 23:40:46 +0000 Received: from esa2.hc3370-68.iphmx.com (unknown [216.71.145.153]) by us1-amaz-eas2.inumbo.com (Halon) with ESMTPS id 01467dc3-32a1-4785-8305-06333bace16f; Tue, 09 Feb 2021 23:40:45 +0000 (UTC) X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: 01467dc3-32a1-4785-8305-06333bace16f DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=citrix.com; s=securemail; t=1612914045; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=yLrkLwcyr2KlIqio3Kl3OKuvXVXkJRZdqlVuUYnouSs=; b=ZkSQJybmRRypFBcR3oFMYTdZtTwWz3hs8D1wHxqwepABDTPi/Zi6ICJQ md8HLnWZPdC/RIUfZCApP45oK8pcabBN+OaBXYGrirSvPQNWrJzMn8u9M l1s8bJI8oawF0NSKPuqf/NF7Ppv4IO7O+uzJHbEchAE9nYX5XN+99jrE3 w=; Authentication-Results: esa2.hc3370-68.iphmx.com; dkim=none (message not signed) header.i=none IronPort-SDR: o5+VlFo9/XotGNHCMH6EKmkRk3thxdZHEXV6A33GZI6Tee3T6QQHiRl5EJZ5+wGbsazcjNRuX7 ditmIDSdIW1qhAyv1YM4/+lPrhTqS9NekLgyy9iFYWH2pklVHKprl11IZWLKNEMooOIlssEhgk 1A8BKG1vMJlE9K8AZs+Ro9ly6ybIwxe/KxVnepm4BWPiY+dXM/AMDkz9DipMDkXFe8bpieSEpV mOyfJ99xz9BHUzhrOE0G4bfacCRmPIcQ9jLoykZdBP6xbXPwE/qpeTFGb2ggxi06+1sF6GZeU2 /UY= X-SBRS: 5.1 X-MesageID: 36942693 X-Ironport-Server: esa2.hc3370-68.iphmx.com X-Remote-IP: 162.221.158.21 X-Policy: $RELAYED X-IronPort-AV: E=Sophos;i="5.81,166,1610427600"; d="scan'208";a="36942693" From: Andrew Cooper To: Xen-devel CC: Andrew Cooper , Jan Beulich , =?UTF-8?q?Roger=20Pau=20Monn=C3=A9?= , Wei Liu , Ian Jackson Subject: [PATCH for-4.15] x86/ucode/amd: Fix OoB read in cpu_request_microcode() Date: Tue, 9 Feb 2021 23:40:19 +0000 Message-ID: <20210209234019.3827-1-andrew.cooper3@citrix.com> X-Mailer: git-send-email 2.11.0 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable X-ZohoMail-DKIM: pass (identity @citrix.com) verify_patch_size() is a maximum size check, and doesn't have a minimum bou= nd. If the microcode container encodes a blob with a length less than 64 bytes, the subsequent calls to microcode_fits()/compare_header() may read off the = end of the buffer. Fixes: 4de936a38a ("x86/ucode/amd: Rework parsing logic in cpu_request_micr= ocode()") Signed-off-by: Andrew Cooper Reviewed-by: Jan Beulich --- CC: Jan Beulich CC: Roger Pau Monn=C3=A9 CC: Wei Liu CC: Ian Jackson In practice, processor_rev_id is the only field read, which is 2 bytes at offset 24 into the header. Not that this makes the bug any less bad. For 4.15. Only dom0 can load new microcode, hence no XSA, but the bug is b= ad and the fix simple and obvious. --- xen/arch/x86/cpu/microcode/amd.c | 1 + 1 file changed, 1 insertion(+) diff --git a/xen/arch/x86/cpu/microcode/amd.c b/xen/arch/x86/cpu/microcode/= amd.c index c4ab395799..cf5947389f 100644 --- a/xen/arch/x86/cpu/microcode/amd.c +++ b/xen/arch/x86/cpu/microcode/amd.c @@ -349,6 +349,7 @@ static struct microcode_patch *cpu_request_microcode(co= nst void *buf, size_t siz if ( size < sizeof(*mc) || (mc =3D buf)->type !=3D UCODE_UCODE_TYPE || size - sizeof(*mc) < mc->len || + mc->len < sizeof(struct microcode_patch) || (!skip_ucode && !verify_patch_size(mc->len)) ) { printk(XENLOG_ERR "microcode: Bad microcode data\n"); --=20 2.11.0