Bug 1335817 (CVE-2014-8181)

Summary: CVE-2014-8181 kernel: scsi: do not fill dirty page content in the SG_IO buffer
Product: [Other] Security Response Reporter: Vladis Dronov <vdronov>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED WONTFIX QA Contact:
Severity: low Docs Contact:
Priority: low    
Version: unspecifiedCC: agordeev, aquini, arm-mgr, bhu, carnil, dhoward, esammons, fhrbata, gansalmon, iboverma, itamar, jforbes, jkacur, joelsmith, jonathan, jross, jwboyer, kernel-maint, kernel-mgr, kstutsma, lgoncalv, lwang, madhu.chinakonda, matt, mchehab, mcressma, mguzik, nmurray, pholasek, plougher, rt-maint, rvrbovsk, williams
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=low,public=20160513,reported=20141209,source=redhat,cvss2=2.1/AV:L/AC:L/Au:N/C:P/I:N/A:N,cwe=CWE-665,rhel-5/kernel=notaffected,rhel-6/kernel=notaffected,rhel-7/kernel=wontfix,rhel-7/kernel-rt=wontfix,mrg-2/realtime-kernel=wontfix,rhelsa-7/arm-kernel=notaffected,fedora-all/kernel=notaffected
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2016-05-13 09:47:28 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---
Bug Depends On:    
Bug Blocks: 1172251    

Description Vladis Dronov 2016-05-13 09:41:06 UTC
In sg_io, blk_rq_map_user{,_iov} may allocate a set of bounce buffer
pages to do the bio, if it finds the user buffer cannot be directly
mapped. But the allocated pages are not cleared.

If the bounce buffer is also not written to by device, garbage data is
left, and copied back to user in blk_rq_unmap_user.

The allocated pages should be cleared. This also eliminates the risk
of leaking sensitive information to userspace, which may have a security
impact.

This flaw is specific to RHEL-7 and does not affect the current upstream kernel.

Comment 1 Vladis Dronov 2016-05-13 09:41:36 UTC
Acknowledgments:

Name: Fam Zheng (Red Hat)

Comment 2 Vladis Dronov 2016-05-13 09:47:28 UTC
Statement:

This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5,6.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 and MRG-2. This has been rated as having Low security impact as exploiting it requires privileged access and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.