Bug 1660604 (CVE-2018-16882)

Summary:	CVE-2018-16882 Kernel: KVM: nVMX: use after free in posted interrupt processing
Product:	[Other] Security Response	Reporter:	Prasad Pandit <ppandit>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	bhu, hkrzesin, hwkernel-mgr, jen, kernel-mgr, williams
Target Milestone:	---	Keywords:	Reopened, Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A use-after-free issue was found in the way the Linux kernel's KVM hypervisor processed posted interrupts when nested(=1) virtualization is enabled. In nested_get_vmcs12_pages(), in case of an error while processing posted interrupt address, it unmaps the 'pi_desc_page' without resetting 'pi_desc' descriptor address, which is later used in pi_test_and_clear_on(). A guest user/process could use this flaw to crash the host kernel resulting in DoS or potentially gain privileged access to a system.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-10 10:44:16 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1660606, 1660948, 1661082
Bug Blocks:	1659455

Description Prasad Pandit 2018-12-18 19:08:40 UTC

A use after free issue was found in the way Linux kernel's KVM hypervisor
processed posted interrupts, when nested(=1) virtualization is enabled.
In nested_get_vmcs12_pages(), in case of an error while processing posted
interrupt address, it unmaps the 'pi_desc_page' without resetting 'pi_desc'
descriptor address. Which is latter used in pi_test_and_clear_on().

A guest user/process could use this flaw to crash the host kernel resulting
in DoS OR potentially gain privileged access to a system.

Upstream patch:
---------------
  -> https://marc.info/?l=kvm&m=154514994222809&w=2

Reference:
----------
  -> https://www.openwall.com/lists/oss-security/2018/12/18/6

Comment 1 Prasad Pandit 2018-12-18 19:08:44 UTC

Acknowledgments:

Name: Cfir Cohen (google.com)

Comment 2 Prasad Pandit 2018-12-18 19:09:05 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1660606]

Comment 6 Pedro Sampaio 2019-01-03 14:19:47 UTC

References:

https://lwn.net/Articles/775720/
https://lwn.net/Articles/775721/