rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: The cdf_read_property_info function in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5.14, does not properly validate a stream offset, which allows remote attackers to cause a denial of service (application crash) via a crafted CDF file.
Vulnerability ID: CVE-2014-3487
CWE: CWE-20
Severity score: 2.9
Project: https://github.com/file/file
Published: 2014-07-09
File: src/cdf.c
Commit message: Add missing check offset test (Francisco Alonso, Jan Kaluza at RedHat)
Commit author: Christos Zoulas

Vulnerable version (before fix):
 #include "file.h"  #ifndef lint FILE_RCSID("@(#)$File: cdf.c,v 1.61 2014/06/04 17:23:19 christos Exp $") #endif  #include <assert.h> cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h, 	if (cdf_check_stream_offset(sst, h, e, 0, __LINE__) == -1) 		goto out; 	for (i = 0; i < sh.sh_properties; i++) { 		size_t ofs = CDF_GETUINT32(p, (i << 1) + 1); 		q = (const uint8_t *)(const void *) 		    ((const char *)(const void *)p + ofs 		    - 2 * sizeof(uint32_t));

Fixed version (after fix):
 #include "file.h"  #ifndef lint FILE_RCSID("@(#)$File: cdf.c,v 1.62 2014/06/04 17:26:07 christos Exp $") #endif  #include <assert.h> cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h, 	if (cdf_check_stream_offset(sst, h, e, 0, __LINE__) == -1) 		goto out; 	for (i = 0; i < sh.sh_properties; i++) { 		size_t tail = (i << 1) + 1; 		if (cdf_check_stream_offset(sst, h, p, tail * sizeof(uint32_t), 		    __LINE__) == -1) 			goto out; 		size_t ofs = CDF_GETUINT32(p, tail); 		q = (const uint8_t *)(const void *) 		    ((const char *)(const void *)p + ofs 		    - 2 * sizeof(uint32_t));

Patch:
patch: @@ -35,7 +35,7 @@
 #include "file.h"
 
 #ifndef lint
-FILE_RCSID("@(#)$File: cdf.c,v 1.61 2014/06/04 17:23:19 christos Exp $")
+FILE_RCSID("@(#)$File: cdf.c,v 1.62 2014/06/04 17:26:07 christos Exp $")
 #endif
 
 #include <assert.h>
@@ -816,7 +816,11 @@ cdf_read_property_info(const cdf_stream_t *sst, const cdf_header_t *h,
 	if (cdf_check_stream_offset(sst, h, e, 0, __LINE__) == -1)
 		goto out;
 	for (i = 0; i < sh.sh_properties; i++) {
-		size_t ofs = CDF_GETUINT32(p, (i << 1) + 1);
+		size_t tail = (i << 1) + 1;
+		if (cdf_check_stream_offset(sst, h, p, tail * sizeof(uint32_t),
+		    __LINE__) == -1)
+			goto out;
+		size_t ofs = CDF_GETUINT32(p, tail);
 		q = (const uint8_t *)(const void *)
 		    ((const char *)(const void *)p + ofs
 		    - 2 * sizeof(uint32_t));
path: src/cdf.c
Vulnerability: Cross-site scripting (XSS) vulnerability in user/profile.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via the Skype ID profile field.
Vulnerability ID: CVE-2014-3544
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/moodle/moodle
Published: 2014-07-29
File: user/profile.php
Commit message: MDL-45683 user: Escaping Skype ID used in profile
Commit author: Osanda Malith Jayathissa

Vulnerable version (before fix):
  if ($user->skype && !isset($hiddenfields['skypeid'])) {     $imurl = 'skype:'.urlencode($user->skype).'?call';     $iconurl = new moodle_url('http://mystatus.skype.com/smallicon/'.$user->skype);     if (strpos($CFG->httpswwwroot, 'https:') === 0) {         // Bad luck, skype devs are lazy to set up SSL on their servers - see MDL-37233.         $statusicon = '';

Fixed version (after fix):
  if ($user->skype && !isset($hiddenfields['skypeid'])) {     $imurl = 'skype:'.urlencode($user->skype).'?call';     $iconurl = new moodle_url('http://mystatus.skype.com/smallicon/'.urlencode($user->skype));     if (strpos($CFG->httpswwwroot, 'https:') === 0) {         // Bad luck, skype devs are lazy to set up SSL on their servers - see MDL-37233.         $statusicon = '';

Patch:
patch: @@ -334,7 +334,7 @@
 
 if ($user->skype && !isset($hiddenfields['skypeid'])) {
     $imurl = 'skype:'.urlencode($user->skype).'?call';
-    $iconurl = new moodle_url('http://mystatus.skype.com/smallicon/'.$user->skype);
+    $iconurl = new moodle_url('http://mystatus.skype.com/smallicon/'.urlencode($user->skype));
     if (strpos($CFG->httpswwwroot, 'https:') === 0) {
         // Bad luck, skype devs are lazy to set up SSL on their servers - see MDL-37233.
         $statusicon = '';
path: user/profile.php
Vulnerability: Race condition in the __kvm_migrate_pit_timer function in arch/x86/kvm/i8254.c in the KVM subsystem in the Linux kernel through 3.17.2 allows guest OS users to cause a denial of service (host OS crash) by leveraging incorrect PIT emulation.
Vulnerability ID: CVE-2014-3611
CWE: CWE-362
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2014-11-10
File: arch/x86/kvm/i8254.c
Commit message: KVM: x86: Improve thread safety in pit

There's a race condition in the PIT emulation code in KVM.  In
__kvm_migrate_pit_timer the pit_timer object is accessed without
synchronization.  If the race condition occurs at the wrong time this
can crash the host kernel.

This fixes CVE-2014-3611.

Cc: stable@vger.kernel.org
Signed-off-by: Andrew Honig <ahonig@google.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Commit author: Andy Honig

Vulnerable version (before fix):
 void __kvm_migrate_pit_timer(struct kvm_vcpu *vcpu) 		return;  	timer = &pit->pit_state.timer; 	if (hrtimer_cancel(timer)) 		hrtimer_start_expires(timer, HRTIMER_MODE_ABS); }  static void destroy_pit_timer(struct kvm_pit *pit)

Fixed version (after fix):
 void __kvm_migrate_pit_timer(struct kvm_vcpu *vcpu) 		return;  	timer = &pit->pit_state.timer; 	mutex_lock(&pit->pit_state.lock); 	if (hrtimer_cancel(timer)) 		hrtimer_start_expires(timer, HRTIMER_MODE_ABS); 	mutex_unlock(&pit->pit_state.lock); }  static void destroy_pit_timer(struct kvm_pit *pit)

Patch:
patch: @@ -262,8 +262,10 @@ void __kvm_migrate_pit_timer(struct kvm_vcpu *vcpu)
 		return;
 
 	timer = &pit->pit_state.timer;
+	mutex_lock(&pit->pit_state.lock);
 	if (hrtimer_cancel(timer))
 		hrtimer_start_expires(timer, HRTIMER_MODE_ABS);
+	mutex_unlock(&pit->pit_state.lock);
 }
 
 static void destroy_pit_timer(struct kvm_pit *pit)
path: arch/x86/kvm/i8254.c
Vulnerability: Heap-based buffer overflow in the php_parserr function in ext/standard/dns.c in PHP 5.6.0beta4 and earlier allows remote servers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted DNS TXT record, related to the dns_get_record function.
Vulnerability ID: CVE-2014-4049
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/php/php-src
Published: 2014-06-18
File: ext/standard/dns.c
Commit message: Merge branch 'PHP-5.6'

* PHP-5.6:
  Fix potential segfault in dns_get_record()
Commit author: Sara Golemon

Vulnerable version (before fix):
 static u_char *php_parserr(u_char *cp, querybuf *answer, int type_to_fetch, int 				 				while (ll < dlen) { 					n = cp[ll]; 					memcpy(tp + ll , cp + ll + 1, n); 					add_next_index_stringl(entries, cp + ll + 1, n, 1); 					ll = ll + n + 1;

Fixed version (after fix):
 static u_char *php_parserr(u_char *cp, querybuf *answer, int type_to_fetch, int 				 				while (ll < dlen) { 					n = cp[ll]; 					if ((ll + n) >= dlen) { 						// Invalid chunk length, truncate 						n = dlen - (ll + 1); 					} 					memcpy(tp + ll , cp + ll + 1, n); 					add_next_index_stringl(entries, cp + ll + 1, n, 1); 					ll = ll + n + 1;

Patch:
patch: @@ -517,6 +517,10 @@ static u_char *php_parserr(u_char *cp, querybuf *answer, int type_to_fetch, int
 				
 				while (ll < dlen) {
 					n = cp[ll];
+					if ((ll + n) >= dlen) {
+						// Invalid chunk length, truncate
+						n = dlen - (ll + 1);
+					}
 					memcpy(tp + ll , cp + ll + 1, n);
 					add_next_index_stringl(entries, cp + ll + 1, n, 1);
 					ll = ll + n + 1;
path: ext/standard/dns.c
Vulnerability: Integer overflow in the LZ4 algorithm implementation, as used in Yann Collet LZ4 before r118 and in the lz4_uncompress function in lib/lz4/lz4_decompress.c in the Linux kernel before 3.15.2, on 32-bit platforms might allow context-dependent attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted Literal Run that would be improperly handled by programs not complying with an API limitation, a different vulnerability than CVE-2014-4715.
Vulnerability ID: CVE-2014-4611
CWE: CWE-20
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2014-07-03
File: lib/lz4/lz4_decompress.c
Commit message: lz4: ensure length does not wrap

Given some pathologically compressed data, lz4 could possibly decide to
wrap a few internal variables, causing unknown things to happen.  Catch
this before the wrapping happens and abort the decompression.

Reported-by: "Don A. Bailey" <donb@securitymouse.com>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Commit author: Greg Kroah-Hartman

Vulnerable version (before fix):
 static int lz4_uncompress(const char *source, char *dest, int osize) 			len = *ip++; 			for (; len == 255; length += 255) 				len = *ip++; 			length += len; 		} 

Fixed version (after fix):
 static int lz4_uncompress(const char *source, char *dest, int osize) 			len = *ip++; 			for (; len == 255; length += 255) 				len = *ip++; 			if (unlikely(length > (size_t)(length + len))) 				goto _output_error; 			length += len; 		} 

Patch:
patch: @@ -72,6 +72,8 @@ static int lz4_uncompress(const char *source, char *dest, int osize)
 			len = *ip++;
 			for (; len == 255; length += 255)
 				len = *ip++;
+			if (unlikely(length > (size_t)(length + len)))
+				goto _output_error;
 			length += len;
 		}
path: lib/lz4/lz4_decompress.c
Vulnerability: The cherokee_validator_ldap_check function in validator_ldap.c in Cherokee 1.2.103 and earlier, when LDAP is used, does not properly consider unauthenticated-bind semantics, which allows remote attackers to bypass authentication via an empty password.
Vulnerability ID: CVE-2014-4668
CWE: CWE-287
Severity score: 6.4
Project: https://github.com/cherokee/webserver
Published: 2014-07-02
File: cherokee/validator_ldap.c
Commit message: Prevent the LDAP validator from accepting an empty password.
Commit author: Stefan de Konink

Vulnerable version (before fix):
 cherokee_validator_ldap_check (cherokee_validator_ldap_t *ldap, 	/* Sanity checks 	 */ 	if ((conn->validator == NULL) || 	    cherokee_buffer_is_empty (&conn->validator->user)) 		return ret_error;  	size = cherokee_buffer_cnt_cspn (&conn->validator->user, 0, "*()");

Fixed version (after fix):
 cherokee_validator_ldap_check (cherokee_validator_ldap_t *ldap, 	/* Sanity checks 	 */ 	if ((conn->validator == NULL) || 	    cherokee_buffer_is_empty (&conn->validator->user) || 	    cherokee_buffer_is_empty (&conn->validator->passwd)) 		return ret_error;  	size = cherokee_buffer_cnt_cspn (&conn->validator->user, 0, "*()");

Patch:
patch: @@ -335,7 +335,8 @@ cherokee_validator_ldap_check (cherokee_validator_ldap_t *ldap,
 	/* Sanity checks
 	 */
 	if ((conn->validator == NULL) ||
-	    cherokee_buffer_is_empty (&conn->validator->user))
+	    cherokee_buffer_is_empty (&conn->validator->user) ||
+	    cherokee_buffer_is_empty (&conn->validator->passwd))
 		return ret_error;
 
 	size = cherokee_buffer_cnt_cspn (&conn->validator->user, 0, "*()");
path: cherokee/validator_ldap.c
Vulnerability: Cross-site scripting (XSS) vulnerability in e107_admin/db.php in e107 2.0 alpha2 and earlier allows remote attackers to inject arbitrary web script or HTML via the type parameter.
Vulnerability ID: CVE-2014-4734
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/e107inc/e107
Published: 2014-07-21
File: e107_admin/db.php
Commit message: Sanitize some request variables
Commit author: SecretR

Vulnerable version (before fix):
 $frm = e107::getForm(); $mes = e107::getMessage();  /*  * Execute trigger  */

Fixed version (after fix):
 $frm = e107::getForm(); $mes = e107::getMessage();  if(isset($_GET['mode'])) {     $_GET['mode'] = preg_match('/[^\w-]/', '', $_GET['mode']); }  if(isset($_GET['type'])) {     $_GET['type'] = preg_replace('/[^\w-]/', '', $_GET['type']); }  /*  * Execute trigger  */

Patch:
patch: @@ -35,6 +35,16 @@
 $frm = e107::getForm();
 $mes = e107::getMessage();
 
+if(isset($_GET['mode']))
+{
+    $_GET['mode'] = preg_match('/[^\w-]/', '', $_GET['mode']);
+}
+
+if(isset($_GET['type']))
+{
+    $_GET['type'] = preg_replace('/[^\w-]/', '', $_GET['type']);
+}
+
 /*
  * Execute trigger
  */
path: e107_admin/db.php
Vulnerability: Cross-site scripting (XSS) vulnerability in odm-init.php in OpenDocMan before 1.2.7.3 allows remote authenticated users to inject arbitrary web script or HTML via the file name of an uploaded file.
Vulnerability ID: CVE-2014-4853
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/opendocman/opendocman
Published: 2014-07-10
File: odm-init.php
Commit message: issue163 - xss issue with files
Commit author: Logical Arts LLC

Vulnerable version (before fix):
 $_REQUEST = sanitizeme($_REQUEST); $_POST = sanitizeme($_POST); $_SERVER = sanitizeme($_SERVER);

Fixed version (after fix):
 $_REQUEST = sanitizeme($_REQUEST); $_POST = sanitizeme($_POST); $_SERVER = sanitizeme($_SERVER); $_FILES = sanitizeme($_FILES);

Patch:
patch: @@ -75,3 +75,4 @@
 $_REQUEST = sanitizeme($_REQUEST);
 $_POST = sanitizeme($_POST);
 $_SERVER = sanitizeme($_SERVER);
+$_FILES = sanitizeme($_FILES);
path: odm-init.php
Vulnerability: The HashContext class in hphp/runtime/ext/ext_hash.cpp in Facebook HipHop Virtual Machine (HHVM) before 3.3.0 incorrectly expects that a certain key string uses '\0' for termination, which allows remote attackers to obtain sensitive information by leveraging read access beyond the end of the string, and makes it easier for remote attackers to defeat cryptographic protection mechanisms by leveraging truncation of a string containing an internal '\0' character.
Vulnerability ID: CVE-2014-6229
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/facebook/hhvm
Published: 2014-12-28
File: hphp/runtime/ext/ext_hash.cpp
Commit message: Fix potential security leak in HashContext

Summary: CVE-2014-6229

This is not a NUL-terminated string, it's a fixed-size block of data.
The risks were key truncation (if there happens to be a NUL byte in the
key) or over-reading (which would be information leakage).

Reviewed By: @ptarjan

Differential Revision: D1533546
Commit author: Owen Yamauchi

Vulnerable version (before fix):
 class HashContext : public SweepableResourceData {     context = malloc(ops->context_size);     ops->hash_copy(context, ctx->context);     options = ctx->options;     key = ctx->key ? strdup(ctx->key) : nullptr;   }    ~HashContext() {

Fixed version (after fix):
 class HashContext : public SweepableResourceData {     context = malloc(ops->context_size);     ops->hash_copy(context, ctx->context);     options = ctx->options;     if (ctx->key) {       key = static_cast<char*>(malloc(ops->block_size));       memcpy(key, ctx->key, ops->block_size);     } else {       key = nullptr;     }   }    ~HashContext() {

Patch:
patch: @@ -152,7 +152,12 @@ class HashContext : public SweepableResourceData {
     context = malloc(ops->context_size);
     ops->hash_copy(context, ctx->context);
     options = ctx->options;
-    key = ctx->key ? strdup(ctx->key) : nullptr;
+    if (ctx->key) {
+      key = static_cast<char*>(malloc(ops->block_size));
+      memcpy(key, ctx->key, ops->block_size);
+    } else {
+      key = nullptr;
+    }
   }
 
   ~HashContext() {
path: hphp/runtime/ext/ext_hash.cpp
Vulnerability: The SMB2_tcon function in fs/cifs/smb2pdu.c in the Linux kernel before 3.16.3 allows remote CIFS servers to cause a denial of service (NULL pointer dereference and client system crash) or possibly have unspecified other impact by deleting the IPC$ share during resolution of DFS referrals.
Vulnerability ID: CVE-2014-7145
CWE: CWE-399
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2014-09-28
File: fs/cifs/smb2pdu.c
Commit message: [CIFS] Possible null ptr deref in SMB2_tcon

As Raphael Geissert pointed out, tcon_error_exit can dereference tcon
and there is one path in which tcon can be null.

Signed-off-by: Steve French <smfrench@gmail.com>
CC: Stable <stable@vger.kernel.org> # v3.7+
Reported-by: Raphael Geissert <geissert@debian.org>
Commit author: Steve French

Vulnerable version (before fix):
 SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree, tcon_error_exit: 	if (rsp->hdr.Status == STATUS_BAD_NETWORK_NAME) { 		cifs_dbg(VFS, "BAD_NETWORK_NAME: %s\n", tree); 		tcon->bad_network_name = true; 	} 	goto tcon_exit; }

Fixed version (after fix):
 SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree, tcon_error_exit: 	if (rsp->hdr.Status == STATUS_BAD_NETWORK_NAME) { 		cifs_dbg(VFS, "BAD_NETWORK_NAME: %s\n", tree); 		if (tcon) 			tcon->bad_network_name = true; 	} 	goto tcon_exit; }

Patch:
patch: @@ -907,7 +907,8 @@ SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree,
 tcon_error_exit:
 	if (rsp->hdr.Status == STATUS_BAD_NETWORK_NAME) {
 		cifs_dbg(VFS, "BAD_NETWORK_NAME: %s\n", tree);
-		tcon->bad_network_name = true;
+		if (tcon)
+			tcon->bad_network_name = true;
 	}
 	goto tcon_exit;
 }
path: fs/cifs/smb2pdu.c
Vulnerability: The xfs_da3_fixhashpath function in fs/xfs/xfs_da_btree.c in the xfs implementation in the Linux kernel before 3.14.2 does not properly compare btree hash values, which allows local users to cause a denial of service (filesystem corruption, and OOPS or panic) via operations on directories that have hash collisions, as demonstrated by rmdir operations.
Vulnerability ID: CVE-2014-7283
CWE: CWE-399
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2014-10-13
File: fs/xfs/xfs_da_btree.c
Commit message: xfs: fix directory hash ordering bug

Commit f5ea1100 ("xfs: add CRCs to dir2/da node blocks") introduced
in 3.10 incorrectly converted the btree hash index array pointer in
xfs_da3_fixhashpath(). It resulted in the the current hash always
being compared against the first entry in the btree rather than the
current block index into the btree block's hash entry array. As a
result, it was comparing the wrong hashes, and so could misorder the
entries in the btree.

For most cases, this doesn't cause any problems as it requires hash
collisions to expose the ordering problem. However, when there are
hash collisions within a directory there is a very good probability
that the entries will be ordered incorrectly and that actually
matters when duplicate hashes are placed into or removed from the
btree block hash entry array.

This bug results in an on-disk directory corruption and that results
in directory verifier functions throwing corruption warnings into
the logs. While no data or directory entries are lost, access to
them may be compromised, and attempts to remove entries from a
directory that has suffered from this corruption may result in a
filesystem shutdown.  xfs_repair will fix the directory hash
ordering without data loss occuring.

[dchinner: wrote useful a commit message]

cc: <stable@vger.kernel.org>
Reported-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: Mark Tinguely <tinguely@sgi.com>
Reviewed-by: Ben Myers <bpm@sgi.com>
Signed-off-by: Dave Chinner <david@fromorbit.com>
Commit author: Mark Tinguely

Vulnerable version (before fix):
 xfs_da3_fixhashpath( 		node = blk->bp->b_addr; 		dp->d_ops->node_hdr_from_disk(&nodehdr, node); 		btree = dp->d_ops->node_tree_p(node); 		if (be32_to_cpu(btree->hashval) == lasthash) 			break; 		blk->hashval = lasthash; 		btree[blk->index].hashval = cpu_to_be32(lasthash);

Fixed version (after fix):
 xfs_da3_fixhashpath( 		node = blk->bp->b_addr; 		dp->d_ops->node_hdr_from_disk(&nodehdr, node); 		btree = dp->d_ops->node_tree_p(node); 		if (be32_to_cpu(btree[blk->index].hashval) == lasthash) 			break; 		blk->hashval = lasthash; 		btree[blk->index].hashval = cpu_to_be32(lasthash);

Patch:
patch: @@ -1295,7 +1295,7 @@ xfs_da3_fixhashpath(
 		node = blk->bp->b_addr;
 		dp->d_ops->node_hdr_from_disk(&nodehdr, node);
 		btree = dp->d_ops->node_tree_p(node);
-		if (be32_to_cpu(btree->hashval) == lasthash)
+		if (be32_to_cpu(btree[blk->index].hashval) == lasthash)
 			break;
 		blk->hashval = lasthash;
 		btree[blk->index].hashval = cpu_to_be32(lasthash);
path: fs/xfs/xfs_da_btree.c
Vulnerability: Race condition in arch/x86/kvm/x86.c in the Linux kernel before 3.17.4 allows guest OS users to cause a denial of service (guest OS crash) via a crafted application that performs an MMIO transaction or a PIO transaction to trigger a guest userspace emulation error report, a similar issue to CVE-2010-5313.
Vulnerability ID: CVE-2014-7842
CWE: CWE-362
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2014-11-30
File: arch/x86/kvm/x86.c
Commit message: KVM: x86: Don't report guest userspace emulation error to userspace

Commit fc3a9157d314 ("KVM: X86: Don't report L2 emulation failures to
user-space") disabled the reporting of L2 (nested guest) emulation failures to
userspace due to race-condition between a vmexit and the instruction emulator.
The same rational applies also to userspace applications that are permitted by
the guest OS to access MMIO area or perform PIO.

This patch extends the current behavior - of injecting a #UD instead of
reporting it to userspace - also for guest userspace code.

Signed-off-by: Nadav Amit <namit@cs.technion.ac.il>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Commit author: Nadav Amit

Vulnerable version (before fix):
 static int handle_emulation_failure(struct kvm_vcpu *vcpu)  	++vcpu->stat.insn_emulation_fail; 	trace_kvm_emulate_insn_failed(vcpu); 	if (!is_guest_mode(vcpu)) { 		vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR; 		vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_EMULATION; 		vcpu->run->internal.ndata = 0;

Fixed version (after fix):
 static int handle_emulation_failure(struct kvm_vcpu *vcpu)  	++vcpu->stat.insn_emulation_fail; 	trace_kvm_emulate_insn_failed(vcpu); 	if (!is_guest_mode(vcpu) && kvm_x86_ops->get_cpl(vcpu) == 0) { 		vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR; 		vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_EMULATION; 		vcpu->run->internal.ndata = 0;

Patch:
patch: @@ -5000,7 +5000,7 @@ static int handle_emulation_failure(struct kvm_vcpu *vcpu)
 
 	++vcpu->stat.insn_emulation_fail;
 	trace_kvm_emulate_insn_failed(vcpu);
-	if (!is_guest_mode(vcpu)) {
+	if (!is_guest_mode(vcpu) && kvm_x86_ops->get_cpl(vcpu) == 0) {
 		vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR;
 		vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_EMULATION;
 		vcpu->run->internal.ndata = 0;
path: arch/x86/kvm/x86.c