Bug 1819615 (CVE-2020-8834) - CVE-2020-8834 Kernel: ppc: kvm: conflicting use of HSTATE_HOST_R1 to store r1 state leads to host stack corruption
Summary: CVE-2020-8834 Kernel: ppc: kvm: conflicting use of HSTATE_HOST_R1 to store r1...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-8834
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1821909 1822166 1823276 1823277 1823278 1823279 1823280 1823281 1823282 1823283
Blocks: 1819617
TreeView+ depends on / blocked
 
Reported: 2020-04-01 07:59 UTC by Dhananjay Arunesh
Modified: 2021-02-16 20:20 UTC (History)
51 users (show)

Fixed In Version: Linux-4.18
Doc Type: Bug Fix
Doc Text:
A flaw was found in the way the KVM hypervisor on the Power8 processor stores the r1 register state in the 'HSTATE_HOST_R1' field on the Linux kernel stack. This flaw occurs while handling hypercalls in Transactional Memory (TM) suspend mode in the kvmppc_save_tm and kvmppc_restore_tm routines, leading to host stack corruption. R1 register holds a stack frame address and its corruption leads the kernel into panic state. A guest user can use this flaw to crash the host kernel, resulting in a denial of service.
Clone Of:
Environment:
Last Closed: 2020-07-07 19:28:05 UTC

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2020:2854 0 None None None 2020-07-07 13:18:58 UTC

Description Dhananjay Arunesh 2020-04-01 07:59:48 UTC 
A flaw was found in the way the KVM hypervisor on the Power8 processor stores the r1 register state in the 'HSTATE_HOST_R1' field on the Linux kernel stack. This flaw occurs while handling hypercalls in Transactional Memory (TM) suspend mode in the kvmppc_save_tm and kvmppc_restore_tm routines, leading to host stack corruption. R1 register holds a stack frame address and its corruption leads the kernel into panic state. A guest user can use this flaw to crash the host kernel, resulting in a denial of service.

Upstream patch:
---------------
  -> https://git.kernel.org/linus/6f597c6b63b6f3675914b5ec8fcd008a58678650
  -> https://git.kernel.org/linus/009c872a8bc4d38f487a9bd62423d019e4322517
  -> https://git.kernel.org/linus/7b0e827c6970e8ca77c60ae87592204c39e41245
Comment 1 Prasad Pandit 2020-04-07 19:40:39 UTC 
External References:

https://www.openwall.com/lists/oss-security/2020/04/06/2
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1867717
Comment 2 Prasad Pandit 2020-04-07 19:41:23 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1821909]
Comment 4 Justin M. Forbes 2020-04-08 13:24:25 UTC 
This was fixed for Fedora with the 4.18 kernel rebases.
Comment 6 Prasad Pandit 2020-04-13 06:38:49 UTC 
Acknowledgments:

Name: Gustavo Romero, Paul Mackerras
Comment 7 Prasad Pandit 2020-04-13 06:46:25 UTC 
Statement:

This issue does not affect the versions of the Linux kernel as shipped with the Red Hat Enterprise Linux 5, 6, 8 and Red Hat Enterprise MRG 2.
This issue affects the versions of the kernel package as shipped with the Red Hat Enterprise Linux 7. Future kernel updates for the Red Hat Enterprise Linux 7 may address this issue.
Comment 23 errata-xmlrpc 2020-07-07 13:18:54 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:2854 https://access.redhat.com/errata/RHSA-2020:2854
Comment 24 Product Security DevOps Team 2020-07-07 19:28:05 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-8834
Note You need to log in before you can comment on or make changes to this bug.