CVE-2014-0049: Buffer Overflow

The problem occurs when the guest performs a pusha with the stack address pointing to an mmio address (or an invalid guest physical address) to start with, but then extending into an ordinary guest physical address. When doing repeated emulated pushes emulatorreadwrite sets mmioneeded to 1 on the first one. On a later push when the stack points to regular memory, mmionrfragments is set to 0, but mmioisneeded is not set to 0.

As a result, KVM exits to userspace, and then returns to completeemulatedmmio. In completeemulatedmmio vcpu->mmiocurfragment is incremented. The termination condition of vcpu->mmiocurfragment == vcpu->mmionrfragments is never achieved. The code bounces back and fourth to userspace incrementing mmiocurfragment past it's buffer. If the guest does nothing else it eventually leads to a a crash on a memcpy from invalid memory address.

However if a guest code can cause the vm to be destoryed in another vcpu with excellent timing, then kvmclearasyncpfcompletionqueue can be used by the guest to control the data that's pointed to by the call to cancelworkitem, which can be used to gain execution.

Introduced by: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f78146b0f

Acknowledgements:

Red Hat would like to thank Lars Bull of Google for reporting this issue.

— Red Hat