Bug 1558149 (CVE-2018-1091) - CVE-2018-1091 kernel: guest kernel crash during core dump on POWER9 host
Summary: CVE-2018-1091 kernel: guest kernel crash during core dump on POWER9 host
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2018-1091
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
: 1558150 1558152 (view as bug list)
Depends On: 1544676 1563773
Blocks: 1558158
TreeView+ depends on / blocked
 
Reported: 2018-03-19 17:44 UTC by Adam Mariš
Modified: 2021-02-17 00:37 UTC (History)
44 users (show)

Fixed In Version: kernel-3.10.0-862.1.1.el7
Clone Of:
Environment:
Last Closed: 2019-06-10 10:18:03 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2018:1318 0 None None None 2018-05-08 18:25:39 UTC

Description Adam Mariš 2018-03-19 17:44:47 UTC 
A kernel crash can be triggered from unprivileged userspace during core dump on a POWER system with a certain configuration due to a missing processor feature check and an erroneous use of transactional memory (TM) instructions in the core dump path leading to a denial of service.

References:

https://marc.info/?l=linuxppc-embedded&m=150535531910494&w=2

http://seclists.org/oss-sec/2018/q1/282

An upstream fix:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c1fa0768a8713b135848f78fd43ffc208d8ded70
Comment 1 Adam Mariš 2018-03-19 17:48:36 UTC 
*** Bug 1558150 has been marked as a duplicate of this bug. ***
Comment 2 Adam Mariš 2018-03-19 17:49:14 UTC 
*** Bug 1558152 has been marked as a duplicate of this bug. ***
Comment 6 Vladis Dronov 2018-03-27 17:15:03 UTC 
Notes:

A certain configuration of POWER system needed to hit the flaw can be:

- The case that kernel was compiled with CONFIG_PPC_TRANSACTIONAL_MEM enabled and ran on a CPU without transactional memory (TM) feature available, thus rendering the execution of TM instructions that are treated by the CPU as illegal instructions. (see this quote in the upstream commit)

- In case of POWER host and KVM guest the core dump code unconditionally tries to use transactional memory (TM) instructions to flush TM state back to the thread structure. As qemu currently disables TM by default in guests, this causes an illegal instruction in the guest kernel and hence the crash.
Comment 9 errata-xmlrpc 2018-05-08 18:25:19 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2018:1318 https://access.redhat.com/errata/RHSA-2018:1318
Note You need to log in before you can comment on or make changes to this bug.