Bug 1144883 (CVE-2014-3610)

Summary:	CVE-2014-3610 kernel: kvm: noncanonical MSR writes
Product:	[Other] Security Response	Reporter:	Petr Matousek <pmatouse>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	agordeev, aquini, areis, carnil, dhoward, drjones, ehabkost, fhrbata, juzhang, kernel-mgr, knoel, lwang, mkenneth, mrezanin, mst, mtosatti, nmurray, pbonzini, pholasek, plougher, pmatouse, rkrcmar, rvrbovsk, security-response-team, shu, stefanha
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	It was found that KVM's Write to Model Specific Register (WRMSR) instruction emulation would write non-canonical values passed in by the guest to certain MSRs in the host's context. A privileged guest user could use this flaw to crash the host.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-04-22 11:05:10 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1144884, 1144885, 1152982, 1152983, 1156543
Bug Blocks:	1144830

Description Petr Matousek 2014-09-21 20:12:19 UTC

If the guest writes a noncanonical value to certain MSR registers, KVM will
write that value to the MSR in the host context and a #GP will be raised
leading to kernel panic.

A privileged guest user can use this flaw to crash the host.

Enabling CONFIG_PARAVIRT when building the kernel mitigates this issue because wrmsrl() ends up invoking safe msr write variant.

Acknowledgements:

Red Hat would like to thank Lars Bull of Google and Nadav Amit for reporting
this issue.

Comment 5 Petr Matousek 2014-10-15 10:30:45 UTC

Statement:

This issue does not affect Linux kernel packages as shipped with Red Hat Enterprise Linux 6 and 7. Future kvm package updates for Red Hat Enterprise Linux 5 may address this issue.

Comment 6 Petr Matousek 2014-10-24 16:07:21 UTC

Upstream patches:

http://git.kernel.org/cgit/virt/kvm/kvm.git/commit/?id=854e8bb1aa06c578c2c9145fa6bfe3680ef63b23
http://git.kernel.org/cgit/virt/kvm/kvm.git/commit/?id=8b3c3104c3f4f706e99365c3e0d2aa61b95f969f

Comment 7 Petr Matousek 2014-10-24 16:09:38 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1156543]

Comment 8 Fedora Update System 2014-10-28 06:44:38 UTC

kernel-3.16.6-203.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 9 Fedora Update System 2014-11-03 05:22:37 UTC

kernel-3.17.2-300.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 10 Fedora Update System 2014-11-16 14:46:13 UTC

kernel-3.14.23-100.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 11 errata-xmlrpc 2015-04-22 10:10:36 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 5

Via RHSA-2015:0869 https://rhn.redhat.com/errata/RHSA-2015-0869.html