Bug 971309 (CVE-2013-2146)

Summary: CVE-2013-2146 Kernel: perf/x86: offcore_rsp valid mask for SNB/IVB
Product: [Other] Security Response Reporter: Prasad J Pandit <ppandit>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: bhu, dhoward, fhrbata, gansalmon, iboverma, itamar, jforbes, jkacur, jonathan, jross, jwboyer, kernel-maint, kernel-mgr, lgoncalv, madhu.chinakonda, matt, mcressma, nobody, pmatouse, rt-maint, rvrbovsk, williams
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 971314, 971315, 971316, 971317    
Bug Blocks: 970909    

Description Prasad J Pandit 2013-06-06 09:12:03 UTC
Linux kernel built with the Performance Events Subsystem(CONFIG_PERF_EVENTS=y)
is vulnerable to a kernel crash flaw, caused by incorrect masking of the
reserved bits.

A user/program could use this flaw to crash the kernel, resulting in DoS.

Upstream fix:
-------------
 -> https://git.kernel.org/linus/f1923820c447e986a9da0fc6bf60c1dccdf0408e

Reference:
----------
 -> http://www.openwall.com/lists/oss-security/2013/06/05/23

Comment 1 Prasad J Pandit 2013-06-06 09:15:14 UTC
Statement:

This issue does not affect the version of the kernel package as shipped with
Red Hat Enterprise Linux 5.

This issue affects the versions of Linux kernel as shipped with
Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG 2. Future kernel updates
for Red Hat Enterprise Linux 6 and Red Hat Enterprise MRG 2 may address this
issue.

Comment 4 errata-xmlrpc 2013-08-27 19:26:20 UTC
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2013:1173 https://rhn.redhat.com/errata/RHSA-2013-1173.html

Comment 5 errata-xmlrpc 2013-09-03 20:29:58 UTC
This issue has been addressed in following products:

  OpenStack 3 for RHEL 6

Via RHSA-2013:1195 https://rhn.redhat.com/errata/RHSA-2013-1195.html

Comment 6 errata-xmlrpc 2013-09-16 17:07:51 UTC
This issue has been addressed in following products:

  MRG for RHEL-6 v.2

Via RHSA-2013:1264 https://rhn.redhat.com/errata/RHSA-2013-1264.html