CVE-2013-1797 (C, published 2013-03-22T11:59Z)
Description: value: Use-after-free vulnerability in arch/x86/kvm/x86.c in the Linux kernel through 3.8.4 allows guest OS users to cause a denial of service (host OS memory corruption) or possibly have unspecified other impact via a crafted application that triggers use of a guest physical address (GPA) in (1) movable or (2) removable memory during an MSR_KVM_SYSTEM_TIME kvm_set_msr_common operation.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-399 \u2014 Resource Management Errors
Weaknesses in this category are related to improper management of system resources.
Repository: https://github.com/torvalds/linux
Files changed:
arch/x86/include/asm/kvm_host.h
arch/x86/kvm/x86.c
Commit message: KVM: x86: Convert MSR_KVM_SYSTEM_TIME to use gfn_to_hva_cache functions (CVE-2013-1797)

There is a potential use after free issue with the handling of
MSR_KVM_SYSTEM_TIME.  If the guest specifies a GPA in a movable or removable
memory such as frame buffers then KVM might continue to write to that
address even after it's removed via KVM_SET_USER_MEMORY_REGION.  KVM pins
the page in memory so it's unlikely to cause an issue, but if the user
space component re-purposes the memory previously used for the guest, then
the guest will be able to corrupt that memory.

Tested: Tested against kvmclock unit test

Signed-off-by: Andrew Honig <ahonig@google.com>
Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>


Vulnerable code:
	unsigned int time_offset;
	struct page *time_page;
	void *shared_kaddr;
	struct pvclock_vcpu_time_info *guest_hv_clock;
	if (!vcpu->time_page)
	shared_kaddr = kmap_atomic(vcpu->time_page);

	guest_hv_clock = shared_kaddr + vcpu->time_offset;
	pvclock_flags = (guest_hv_clock->flags & PVCLOCK_GUEST_STOPPED);
	memcpy(shared_kaddr + vcpu->time_offset, &vcpu->hv_clock,
	       sizeof(vcpu->hv_clock));

	kunmap_atomic(shared_kaddr);

	mark_page_dirty(v->kvm, vcpu->time >> PAGE_SHIFT);
	if (vcpu->arch.time_page) {
		kvm_release_page_dirty(vcpu->arch.time_page);
		vcpu->arch.time_page = NULL;
	}
		/* ...but clean it before doing the actual write */
		vcpu->arch.time_offset = data & ~(PAGE_MASK | 1);
		if (vcpu->arch.time_offset &
				(sizeof(struct pvclock_vcpu_time_info) - 1))
		vcpu->arch.time_page =
				gfn_to_page(vcpu->kvm, data >> PAGE_SHIFT);

		if (is_error_page(vcpu->arch.time_page))
			vcpu->arch.time_page = NULL;
	if (!vcpu->arch.time_page)

Fixed code:
	struct gfn_to_hva_cache pv_time;
	bool pv_time_enabled;
	struct pvclock_vcpu_time_info guest_hv_clock;
	if (!vcpu->pv_time_enabled)
	if (unlikely(kvm_read_guest_cached(v->kvm, &vcpu->pv_time,
		&guest_hv_clock, sizeof(guest_hv_clock))))
		return 0;
	pvclock_flags = (guest_hv_clock.flags & PVCLOCK_GUEST_STOPPED);
	kvm_write_guest_cached(v->kvm, &vcpu->pv_time,
				&vcpu->hv_clock,
				sizeof(vcpu->hv_clock));
	vcpu->arch.pv_time_enabled = false;
		u64 gpa_offset;
		gpa_offset = data & ~(PAGE_MASK | 1);
		if (gpa_offset & (sizeof(struct pvclock_vcpu_time_info) - 1))
		if (kvm_gfn_to_hva_cache_init(vcpu->kvm,
		     &vcpu->arch.pv_time, data & ~1ULL))
			vcpu->arch.pv_time_enabled = false;
		else
			vcpu->arch.pv_time_enabled = true;
	if (!vcpu->arch.pv_time_enabled)
	vcpu->arch.pv_time_enabled = false;