Bug 1510399 (CVE-2017-15306)

Summary: CVE-2017-15306 Kernel: KVM: oops when checking KVM_CAP_PPC_HTM on PPC platform
Product: [Other] Security Response Reporter: Prasad Pandit <ppandit>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: airlied, ajax, aquini, bhu, blc, bskeggs, dhoward, ewk, fhrbata, hdegoede, hkrzesin, hwkernel-mgr, iboverma, ichavero, itamar, jarodwilson, jeremy, jforbes, jkacur, john.j5live, jonathan, josef, jross, jwboyer, kernel-maint, kernel-mgr, lgoncalv, linville, mchehab, mcressma, mjg59, mlangsdo, nmurray, rvrbovsk, steved, williams
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-10-27 10:53:35 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1510400, 1510403, 1510404    
Bug Blocks: 1510302    

Description Prasad Pandit 2017-11-07 10:28:51 UTC 
Linux kernel built with the KVM virtualization(CONFIG_KVM) support
for PowerPC platform(CONFIG_PPC), is vulnerable to a NULL pointer
de-reference issue. It could occur when an unprivileged user attempts
to check if the PPC hardware supports Transactional Memory(KVM_CAP_PPC_HTM).

An unprivileged user could use this flaw to crash the kernel resulting
in DoS scenario.

Upstream patch:
---------------
  -> https://git.kernel.org/linus/ac64115a66c18c01745bbd3c47a36b124e5fd8c0

Reference:
----------
  -> http://www.openwall.com/lists/oss-security/2017/11/06/6
Comment 1 Prasad Pandit 2017-11-07 10:29:54 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1510400]
Comment 4 Prasad Pandit 2017-11-07 10:51:38 UTC 
Statement:

This issue does not affect the versions of the kernel package as shipped with
Red Hat Enterprise Linux 5, 6, 7 and Red Hat Enterprise MRG 2.
Comment 6 Justin M. Forbes 2017-11-07 13:12:54 UTC 
This is fixed with the 4.13.11 stable update for Fedora.