Bug 1301893 – CVE-2016-2069 kernel: race condition in the TLB flush logic

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1301893 - (CVE-2016-2069) CVE-2016-2069 kernel: race condition in the TLB flush logic

Summary:	CVE-2016-2069 kernel: race condition in the TLB flush logic

Status:	NEW

Aliases:	CVE-2016-2069

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20160125,repor...
Keywords:	Security

Depends On:	1332601 1332602 1332603 1332604
Blocks:	1301883
	Show dependency tree / graph

Reported:	2016-01-26 04:58 EST by Andrej Nemec
Modified:	2018-08-28 18:02 EDT (History)
CC List:	11 users (show)

See Also:
Fixed In Version:
Doc Type:	Bug Fix
Doc Text:	A flaw was discovered in the way the Linux kernel dealt with paging structures. When the kernel invalidated a paging structure that was not in use locally, it could, in principle, race against another CPU that is switching to a process that uses the paging structure in question. A local user could use a thread running with a stale cached virtual->physical translation to potentially escalate their privileges if the translation in question were writable and the physical page got reused for something critical (for example, a page table).
Story Points:	---
Clone Of:
Environment:
Last Closed:
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2016:2574	normal	SHIPPED_LIVE	Important: kernel security, bug fix, and enhancement update	2016-11-03 08:06:10 EDT
Red Hat Product Errata	RHSA-2016:2584	normal	SHIPPED_LIVE	Important: kernel-rt security, bug fix, and enhancement update	2016-11-03 08:08:49 EDT
Red Hat Product Errata	RHSA-2017:0817	normal	SHIPPED_LIVE	Moderate: kernel security, bug fix, and enhancement update	2017-03-21 09:06:51 EDT

Groups: None (edit)

Description Andrej Nemec 2016-01-26 04:58:16 EST

A flaw was discovered in a way the Linux deals with paging structures.
When Linux invalidates a paging structure that is not in use locally, it could, in principle, race against another CPU that is switching to a process that uses the paging structure in question.

External reference:

http://seclists.org/oss-sec/2016/q1/194

Upstream fix:

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=71b3c126e61177eb693423f2e18a1914205b165e

CVE assignment:

http://seclists.org/oss-sec/2016/q1/210

Comment 6 Vladis Dronov 2016-05-03 13:18:37 EDT

Statement:

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5. This has been rated as having Moderate security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 6, 7 and MRG-2. Future Linux kernel updates for the respective releases might address this issue.

Comment 7 errata-xmlrpc 2016-11-03 11:12:12 EDT

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2016:2574 https://rhn.redhat.com/errata/RHSA-2016-2574.html

Comment 8 errata-xmlrpc 2016-11-03 15:40:41 EDT

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2016:2584 https://rhn.redhat.com/errata/RHSA-2016-2584.html

Comment 9 errata-xmlrpc 2016-11-03 17:31:44 EDT

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2016:2574 https://rhn.redhat.com/errata/RHSA-2016-2574.html

Comment 10 errata-xmlrpc 2016-11-03 17:47:13 EDT

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2016:2584 https://rhn.redhat.com/errata/RHSA-2016-2584.html

Comment 11 errata-xmlrpc 2017-03-21 08:33:47 EDT

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2017:0817 https://rhn.redhat.com/errata/RHSA-2017-0817.html

Note You need to log in before you can comment on or make changes to this bug.