Bug 1204722 (CVE-2015-2666)

Summary: CVE-2015-2666 kernel: execution in the early microcode loader
Product: [Other] Security Response Reporter: Vasyl Kaigorodov <vkaigoro>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aquini, bhu, ccoleman, dhoward, dmcphers, fhrbata, gansalmon, iboverma, itamar, jforbes, jialiu, joelsmith, jokerman, jonathan, jross, jwboyer, kernel-maint, kernel-mgr, lmeyer, madhu.chinakonda, matt, mchehab, mcressma, mmccomas, mrg-program-list, nmurray, plougher, pmatouse, rvrbovsk, williams, wmealing
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
A stack-based buffer overflow flaw was found in the Linux kernel's early load microcode functionality. On a system with UEFI Secure Boot enabled, a local, privileged user could use this flaw to increase their privileges to the kernel (ring0) level, bypassing intended restrictions in place.
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-06-08 02:40:20 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1204724, 1206829, 1206830, 1206831, 1206832    
Bug Blocks: 1204723    

Description Vasyl Kaigorodov 2015-03-23 12:15:35 UTC
It was found that the Linux kernel's Intel early microcode loader was vulnerable to a stack overflow.

On a UEFI Secure Boot enabled system, a local root user could use this flaw to increase their privileges to the kernel (ring0) level despite the additional restrictions in place.

Upstream fix:

https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit?id=f84598bd7c851f8b0bf8cd0d7c3be0d73c432ff4

Comment 1 Vasyl Kaigorodov 2015-03-23 12:17:02 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1204724]

Comment 4 Petr Matousek 2015-03-28 22:14:08 UTC
Statement:

This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6 and Red Hat Enteprise MRG 2. Future kernel and kernel-rt updates for Red Hat Enterprise Linux 7 may address this issue.

Comment 5 Fedora Update System 2015-03-29 04:31:18 UTC
kernel-3.19.2-201.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Fedora Update System 2015-04-07 07:29:36 UTC
kernel-3.19.3-100.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 8 errata-xmlrpc 2015-08-05 20:13:40 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2015:1565 https://access.redhat.com/errata/RHSA-2015:1565

Comment 9 errata-xmlrpc 2015-08-06 02:42:36 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2015:1534 https://rhn.redhat.com/errata/RHSA-2015-1534.html