Re: [PATCH 2/2] x86/tdx: Do not allow #VE due to EPT violation on the private memory

[Kirill A. Shutemov]

On Mon, Oct 31, 2022 at 12:07:45PM +0800, Guorui Yu wrote:
> The core of this vulnerability is not directly related to the
> ATTR_SEPT_VE_DISABLE, but the MMIO processing logic in #VE.
> 
> We have encountered similar problems on SEV-ES, here are their fixes on
> Kernel [1] and OVMF[2].
> 
> Instead of enforcing the ATTR_SEPT_VE_DISABLE in TDX guest kernel, I think
> the fix should also include necessary check on the MMIO path of the #VE
> routine.

Missing SEPT_VE_DISABLE exposes to more security problems than confused
handle_mmio(). Rogue #VE that is rightly timed can be used to escalate
privileges and more. Just adding check there would solve only some
potential attacks.

> static int handle_mmio(struct pt_regs *regs, struct ve_info *ve)
> {
> 	unsigned long *reg, val, vaddr;
> 	char buffer[MAX_INSN_SIZE];
> 	struct insn insn = {};
> 	enum mmio_type mmio;
> 	int size, extend_size;
> 	u8 extend_val = 0;
> 
> 	// Some addtional security check about ve->gpa should be introduced here.
> 
> 	/* Only in-kernel MMIO is supported */
> 	if (WARN_ON_ONCE(user_mode(regs)))
> 		return -EFAULT;
> 
> 	// ...
> }
> 
> If we don't fix the problem at the point where we found, but rely on
> complicated composite logic and long comments in the kernel, I'm confident
> we'll fall back into the same pit in the near future :).

The plan is to add the check there along with relaxing SEPT_VE_DISABLE for
debug TD. It is required to debug guest kernel effectively. Otherwise
access to unaccepted memory would terminate TD with zero info on why.

But it is not the urgent fix. It can be submitted separately.

-- 
  Kiryl Shutsemau / Kirill A. Shutemov