Page MenuHomeFreeBSD

mitigate against CVE-2017-5715 by clearing registers upon returning from the guest
ClosedPublic

Authored by tychon on Jan 15 2018, 5:15 PM.

Details

Reviewers
grehan
rgrimes
Group Reviewers
bhyve
Summary

Provide some mitigation against CVE-2017-5715 by clearing registers
upon returning from the guest which aren't immediately clobbered by
the host. This eradicates any remaining guest contents limitings
their usefulness in an exploit gadget.

This was inspired by this linux commit:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5b6c02f38315b720c593c6079364855d276886aa

Diff Detail

Repository
rS FreeBSD src repository
Lint
Lint Skipped
Unit
Unit Tests Skipped
Build Status
Buildable 14387

Event Timeline

tychon created this revision.Jan 15 2018, 5:15 PM

Add bhyve review group.

Tested the SVM codepath with a Win10 guest on an AMD Sempron APU.

grehan accepted this revision as: grehan.Jan 15 2018, 6:09 PM
This revision is now accepted and ready to land.Jan 15 2018, 6:09 PM
rgrimes accepted this revision as: rgrimes.Jan 15 2018, 6:22 PM
rgrimes added a subscriber: rgrimes.

Looks good to me, but a future refactor would be nice, #define VMX_GUEST_CLOBBER_INTEL and VMX_GUEST_CLOBBER_AMD and invoke them at the right place. Makes the *_support.S files less different from each other.

emaste added a subscriber: emaste.Jan 15 2018, 8:21 PM

Committed in rS328011 (which incorrectly referenced D13573)

mmacy closed this revision.May 15 2018, 5:48 PM