Bug 308811 (CVE-2007-3850)

Summary:	CVE-2007-3850 kernel LTC31426-4k page mapping support for userspace in 64k kernels
Product:	[Other] Security Response	Reporter:	Mark J. Cox <mjc>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	urgent
Version:	unspecified	CC:	dhoward, dledford, gozen, jturner, konradr, poelstra, security-response-team, smoser, tao
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	ppc64
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2008-01-17 15:38:26 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	250144, 275841
Bug Blocks:

Description Mark J. Cox 2007-09-27 12:12:34 UTC

The eHCA driver has a problem with mapping userspace resources.  It's nicely
explained in the upstream git submission:
Some drivers have resources that they want to be able to map into
userspace that are 4k in size.	On a kernel configured with 64k pages
we currently end up mapping the 4k we want plus another 60k of
physical address space, which could contain anything.  This can
introduce security problems, for example in the case of an infiniband
adaptor where the other 60k could contain registers that some other
program is using for its communications.

Upstream patch:
http://patchwork.ozlabs.org/linuxppc/patch?id=10281
and commit:
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=721151d004dcf01a71b12bb6b893f9160284cf6e

galaxy has a 4k page of control registers for each single QP and CQ.
The physical adress of this page is defined by phyp when you allocate a resource.

To be able to send and receive data from userspace without a kernel call you
have to get access to that 4k page from userspace.
If the linux kernel only allows to map 64k pages into userspace there's a
conflict. Phyp only allows to map this page area in 4k chunks (H_ENTER).

* a flaw in the eHCA driver on PowerPC architectures that allowed a local
user to access 60k of physical address space.

Comment 3 Red Hat Product Security 2008-01-17 15:38:26 UTC

This issue was addressed in:

Red Hat Enterprise Linux:
  http://rhn.redhat.com/errata/RHSA-2007-0940.html