Bug 1738708 (CVE-2018-20855)

Summary:	CVE-2018-20855 kernel: Information leak in create_qp_common in drivers/infiniband/hw/mlx5/qp.c
Product:	[Other] Security Response	Reporter:	Pedro Sampaio <psampaio>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	acaringi, airlied, bhu, blc, brdeoliv, bskeggs, dhoward, dvlasenk, esammons, fhrbata, hdegoede, hkrzesin, iboverma, ichavero, itamar, jarodwilson, jeremy, jforbes, jlelli, john.j5live, jonathan, josef, jross, jshortt, jstancek, jwboyer, kernel-maint, kernel-mgr, lgoncalv, linville, mchehab, mcressma, mjg59, mlangsdo, nmurray, rt-maint, rvrbovsk, steved, williams, wmealing
Target Milestone:	---	Keywords:	Reopened, Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was discovered in the Linux kernel's implementation of InfiniBand. A local attacker who is able to execute a read from the InfiniBand device could trigger an information leak of kernel memory to userspace which can be used to further attack the system.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-25 22:11:50 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1738709, 1773437, 1773438, 1773439
Bug Blocks:	1738710

Description Pedro Sampaio 2019-08-07 22:23:24 UTC

A flaw was discovered in the Linux kernels implementation of infiniband for MLX5. A local attacker who is able to execute a read from the infiband device could trigger an information leak of kernel memory to userspace which can be used to further attack the system.


Additional Information:
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.7
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0625b4ba1a5d4703c7fb01c497bd6c156908af00

Comment 1 Pedro Sampaio 2019-08-07 22:23:42 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1738709]

Comment 2 Justin M. Forbes 2019-08-08 09:27:06 UTC

This was fixed in Fedora with the 4.18.7 stable kernel update.

Comment 7 Eric Christensen 2019-11-20 16:05:51 UTC

Mitigation:

If the InfiniBand device is in use, there is no known mitigation for this flaw.  If the InfiniBand device is not in use, the kernel module (mlx5_ib) can be blacklisted and unloaded.

Comment 8 Wade Mealing 2020-02-06 01:57:30 UTC

This was fixed in rhel-7 in the kernel-3.10.0-1013.el7 release, earlier versions were affected.