Bug 730341 (CVE-2011-3131)

Summary:	CVE-2011-3131 kernel: xen: IOMMU fault livelock
Product:	[Other] Security Response	Reporter:	Petr Matousek <pmatouse>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	anton, dhoward, lwang, plougher, sforsber, xen-maint
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-05-10 12:58:16 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	730342, 730343
Bug Blocks:	730344

Description Petr Matousek 2011-08-12 14:36:11 UTC

A VM that controls a PCI[E] device directly can cause it to issue DMA requests to invalid addresses. Although these requests are denied by the IOMMU, the hypervisor needs to handle the interrupt and clear the error from the IOMMU, and this can be used to live-lock a CPU and potentially hang the host.

A malicious guest administrator of a VM that has direct control of a PCI[E] device can cause a performance degradation, and possibly hang the host.

Upstream patches:
changeset 23762:537ed3b74b3f of xen-unstable.hg
changeset 23112:84e3706df07a of xen-4.1-testing.hg

References:
http://permalink.gmane.org/gmane.comp.emulators.xen.devel/109514
http://lists.xensource.com/archives/html/xen-devel/2011-06/msg01106.html 
http://xenbits.xen.org/hg/staging/xen-unstable.hg/rev/537ed3b74b3f
http://xenbits.xen.org/hg/staging/xen-4.1-testing.hg/rev/84e3706df07a

Comment 2 Petr Matousek 2011-08-12 14:44:20 UTC

Statement:

The versions of the Linux kernel as shipped with Red Hat Enterprise Linux 4, 6,
and Red Hat Enterprise MRG are not affected. It has been addressed in Red Hat Enterprise Linux 5 via https://rhn.redhat.com/errata/RHSA-2011-1386.html.

Comment 3 errata-xmlrpc 2011-10-20 17:28:57 UTC

This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2011:1386 https://rhn.redhat.com/errata/RHSA-2011-1386.html