Bug 1819615 (CVE-2020-8834)
| Summary: | CVE-2020-8834 Kernel: ppc: kvm: conflicting use of HSTATE_HOST_R1 to store r1 state leads to host stack corruption | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Dhananjay Arunesh <darunesh> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED ERRATA | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | acaringi, airlied, bhu, blc, bmasney, brdeoliv, bskeggs, dhoward, dvlasenk, esammons, fhrbata, hdegoede, hkrzesin, iboverma, ichavero, itamar, jarodwilson, jeremy, jforbes, jglisse, jlelli, jmaloy, john.j5live, jonathan, josef, jross, jshortt, jstancek, jwboyer, kernel-maint, kernel-mgr, labbott, lgoncalv, linville, masami256, matt, mchehab, mcressma, mdeng, mjg59, mlangsdo, nmurray, ppandit, qzhang, qzhao, rt-maint, rvrbovsk, security-response-team, steved, williams, xuma |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Linux-4.18 | Doc Type: | Bug Fix |
| Doc Text: |
A flaw was found in the way the KVM hypervisor on the Power8 processor stores the r1 register state in the 'HSTATE_HOST_R1' field on the Linux kernel stack. This flaw occurs while handling hypercalls in Transactional Memory (TM) suspend mode in the kvmppc_save_tm and kvmppc_restore_tm routines, leading to host stack corruption. R1 register holds a stack frame address and its corruption leads the kernel into panic state. A guest user can use this flaw to crash the host kernel, resulting in a denial of service.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-07-07 19:28:05 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1821909, 1822166, 1823276, 1823277, 1823278, 1823279, 1823280, 1823281, 1823282, 1823283 | ||
| Bug Blocks: | 1819617 | ||
|
Description
Dhananjay Arunesh
2020-04-01 07:59:48 UTC
External References: https://www.openwall.com/lists/oss-security/2020/04/06/2 https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1867717 Created kernel tracking bugs for this issue: Affects: fedora-all [bug 1821909] This was fixed for Fedora with the 4.18 kernel rebases. Acknowledgments: Name: Gustavo Romero, Paul Mackerras Statement: This issue does not affect the versions of the Linux kernel as shipped with the Red Hat Enterprise Linux 5, 6, 8 and Red Hat Enterprise MRG 2. This issue affects the versions of the kernel package as shipped with the Red Hat Enterprise Linux 7. Future kernel updates for the Red Hat Enterprise Linux 7 may address this issue. This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2020:2854 https://access.redhat.com/errata/RHSA-2020:2854 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-8834 |