Bug 1604217 (CVE-2018-9422)

Summary:	CVE-2018-9422 kernel: Elevation of Privilege in futex
Product:	[Other] Security Response	Reporter:	Laura Pardo <lpardo>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	unspecified	CC:	abhgupta, airlied, aquini, bhu, blc, bskeggs, dbaker, dhoward, esammons, ewk, fhrbata, hdegoede, hkrzesin, hwkernel-mgr, iboverma, ichavero, itamar, jarodwilson, jforbes, jglisse, jkacur, john.j5live, jokerman, jonathan, josef, jross, jrusnack, jwboyer, kernel-maint, kernel-mgr, labbott, lgoncalv, linville, lwang, matt, mchehab, mcressma, mguzik, mjg59, mlangsdo, nmurray, plougher, rt-maint, rvrbovsk, skozina, steved, sthangav, trankin, vdronov, williams
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	kernel 4.6-rc1	Doc Type:	If docs needed, set a value
Doc Text:	Non-optimized code for key handling of shared futexes was found in the Linux kernel in the form of unbounded contention time due to the page lock for real-time users. Before the fix, the page lock was an unnecessarily heavy lock for the futex path that protected too much. After the fix, the page lock is only required in a specific corner case.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-08-02 11:45:10 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1604228

Description Laura Pardo 2018-07-19 21:35:28 UTC

An unoptimized code of key handling for shared futexes was found in the Linux kernel in the form of unbounded contention time due to the page lock for real-time users. Before the fix the page lock was a heavy unnecessary lock for the futex path that protected too much. After the fix the page lock is only required in a specific corner case.

References:

https://source.android.com/security/bulletin/2018-07-01

https://marc.info/?w=2&r=1&s=futex%3A+Remove+requirement+for+lock_page&q=t (the discussions)

https://lore.kernel.org/patchwork/patch/645516/

Upstream patches:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=65d8fc777f6dcfee12785c057a6b57f679641c90

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=48fb6f4db940e92cfb16cd878cddd59ea6120d06

Comment 3 Vladis Dronov 2018-08-02 11:45:10 UTC

Notes:

It does not look like this flaw can be exploited and even if it is really a security flaw at all. Probably, there is a confusion about the commit messages as it mentions "one rare race". Actually no race was addressed by the commit but the commit message could be interpreted so, as fixing a race related to shmem pages and a swapcache.