Description
In the Linux kernel, the following vulnerability has been resolved: virt: sev-guest: Do not use host-controlled page order in cleanup path When issuing an extended guest request (SVM_VMGEXIT_EXT_GUEST_REQUEST), get_ext_report() allocates a buffer to retrieve a certificate blob from the host, keeping track of its size in report_req->certs_len. However, the host may return SNP_GUEST_VMM_ERR_INVALID_LEN, indicating an invalid buffer size, as well as the expected length of such buffer. get_ext_report() subsequently updates report_req->certs_len with the host-controlled value, and cleans up the buffer by computing a page order from such value. This is incorrect, as the host-provided length may not match the page order of the original allocation, potentially resulting in corruption in the page allocator. Fix this by using alloc_pages_exact() instead, and reusing @npages to compute the size passed to free_pages_exact(). For consistency, also use @npages to compute the size when allocating the pages, even though this last change has no functional effect.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
3e385c0d6ce88ac9916dcf84267bd5855d830748 to < 3f6fb0211b39aaa1b841260681dd02ca6b693ed5affected3e385c0d6ce88ac9916dcf84267bd5855d830748 to < 9e48b4f813d2c3db75d522aa82ab705ce04b7e2daffected3e385c0d6ce88ac9916dcf84267bd5855d830748 to < 23e6a1ca04ae44806439a5a446e62e4d42e80bb4affected0b16521f95c875e79d657cb8d6911c15080dbb80affected6.13.8 to < 6.14affected
Linux Linux
Default version status: affected
6.14affected0 to < 6.14unaffected6.18.33 to ≤ 6.18.*unaffected7.0.10 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected