CVE-2014-0049.patch
The problem occurs when the guest performs a pusha with the stack
address pointing to an mmio address (or an invalid guest physical
address) to start with, but then extending into an ordinary guest
physical address.  When doing repeated emulated pushes
emulator_read_write sets mmio_needed to 1 on the first one.  On a
later push when the stack points to regular memory,
mmio_nr_fragments is set to 0, but mmio_is_needed is not set to 0.

As a result, KVM exits to userspace, and then returns to
complete_emulated_mmio.  In complete_emulated_mmio
vcpu->mmio_cur_fragment is incremented.  The termination condition of
vcpu->mmio_cur_fragment == vcpu->mmio_nr_fragments is never achieved.
The code bounces back and fourth to userspace incrementing
mmio_cur_fragment past it's buffer.  If the guest does nothing else it
eventually leads to a a crash on a memcpy from invalid memory address.

However if a guest code can cause the vm to be destoryed in another
vcpu with excellent timing, then kvm_clear_async_pf_completion_queue
can be used by the guest to control the data that's pointed to by the
call to cancel_work_item, which can be used to gain execution.

This bug was introduced by f78146b0f.

Created attachment 580533 [details]
CVE-2014-0049.patch

proposed patch

https://git.kernel.org/cgit/virt/kvm/kvm.git/commit/?id=a08d3b3b99efd509133946056531cdf8f3a0c09b

complete_emulated_mmio does not seem to appear in SLES 11 SP3 or olders.

The referenced breakage patch is also from 2012, so we probably do not have it in 3.0.x-

(In reply to comment #5)
> complete_emulated_mmio does not seem to appear in SLES 11 SP3 or olders.
> 
> The referenced breakage patch is also from 2012, so we probably do not have it
> in 3.0.x-

I've looked and we do not have this breakage in SLES 11 SP3 or older.

Currently openSUSE 12.3 and openSUSE 13.1 are affected, as well as the
pre-releases of SLES 12.

I assume we're ok waiting for this fix to appear in the stable 3.12 updates,
and get incorporated into SLE 12 that way.

For the two openSUSE releases, I can work to get the fix into their kernels.
Marcus, you might have better visibility into what is going on with the CRD, so
I'll wait for your input as to when to push the fix out to these two openSUSE
releases.

bugbot adjusting priority

issue is now public btw, so feel free to commit

is in patches.kernel.org/patch-3.12.13-14

so we had it fixed pre-SLE12 GA shipment.

13.1 has also moved to a 3.12.later kernel, so is also fixed.