A flaw was found in the way the KVM hypervisor on the Power8 processor stores the r1 register state in the 'HSTATE_HOST_R1' field on the Linux kernel stack. This flaw occurs while handling hypercalls in Transactional Memory (TM) suspend mode in the kvmppc_save_tm and kvmppc_restore_tm routines, leading to host stack corruption. R1 register holds a stack frame address and its corruption leads the kernel into panic state. A guest user can use this flaw to crash the host kernel, resulting in a denial of service.
Created kernel tracking bugs for this issue:
Affects: fedora-all [bug 1821909]
This was fixed for Fedora with the 4.18 kernel rebases.
Name: Gustavo Romero, Paul Mackerras
This issue does not affect the versions of the Linux kernel as shipped with the Red Hat Enterprise Linux 5, 6, 8 and Red Hat Enterprise MRG 2.
This issue affects the versions of the kernel package as shipped with the Red Hat Enterprise Linux 7. Future kernel updates for the Red Hat Enterprise Linux 7 may address this issue.
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2020:2854 https://access.redhat.com/errata/RHSA-2020:2854
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):