Bug 1172765 (CVE-2014-8134)

Summary:	CVE-2014-8134 kernel: x86: espfix not working for 32-bit KVM paravirt guests
Product:	[Other] Security Response	Reporter:	Petr Matousek <pmatouse>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	agordeev, aquini, bhu, carnil, dhoward, esammons, fhrbata, gansalmon, iboverma, itamar, jforbes, jkacur, jonathan, jross, jwboyer, kernel-maint, kernel-mgr, lgoncalv, lwang, madhu.chinakonda, matt, mchehab, mcressma, mguzik, nmurray, pholasek, plougher, rt-maint, rvrbovsk, williams
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	It was found that the espfix functionality does not work for 32-bit KVM paravirtualized guests. A local, unprivileged guest user could potentially use this flaw to leak kernel stack addresses.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2016-05-11 07:27:18 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1172767, 1172769
Bug Blocks:	1170693

Description Petr Matousek 2014-12-10 17:12:41 UTC

It was found that espfix funcionality (when returning to userspace with a 16
bit stack, the CPU will not restore the high word of esp for us on executing
iret and thus potentially leaks kernel addresses; espfix fixes this) does not
work for 32-bit KVM paravirt guests.

A local unprivileged user could potentially use this flaw to leak kernel
stack addresses.

Proposed upstream patch:
http://www.spinics.net/lists/kvm/msg111458.html

Acknowledgements:

Red Hat would like to thank Andy Lutomirski for reporting this issue.

Comment 1 Petr Matousek 2014-12-10 17:13:17 UTC

Statement:

This issue did not affect the Linux kernel packages as shipped with Red
Hat Enterprise Linux 5 and 7, and Red Hat Enterprise Linux MRG 2.

Comment 3 Petr Matousek 2014-12-10 17:14:47 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1172769]

Comment 4 Petr Matousek 2014-12-15 18:28:08 UTC

Upstream patch:

https://git.kernel.org/cgit/virt/kvm/kvm.git/commit/?h=linux-next&id=29fa6825463c97e5157284db80107d1bfac5d77b

Comment 5 Fedora Update System 2014-12-21 06:36:34 UTC

kernel-3.17.7-200.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Fedora Update System 2014-12-22 02:32:43 UTC

kernel-3.17.7-300.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 7 Fedora Update System 2015-01-05 07:34:46 UTC

kernel-3.14.27-100.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 8 errata-xmlrpc 2016-05-10 22:06:11 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2016:0855 https://rhn.redhat.com/errata/RHSA-2016-0855.html