Bug 1900844 (CVE-2020-27777) - CVE-2020-27777 kernel: powerpc: RTAS calls can be used to compromise kernel integrity
Summary: CVE-2020-27777 kernel: powerpc: RTAS calls can be used to compromise kernel i...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-27777
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1912473 1900845 1906443 1906444 1906445
Blocks: 1888425 1927621
TreeView+ depends on / blocked
 
Reported: 2020-11-23 20:30 UTC by Guilherme de Almeida Suckevicz
Modified: 2021-11-09 18:22 UTC (History)
40 users (show)

Fixed In Version: kernel 5.10-rc1
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the way RTAS handled memory accesses in userspace to kernel communication. On a locked down (usually due to Secure Boot) guest system running on top of PowerVM or KVM hypervisors (pseries platform) a root like local user could use this flaw to further increase their privileges to that of a running kernel.
Clone Of:
Environment:
Last Closed: 2021-08-31 11:57:33 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2021:3327 0 None None None 2021-08-31 09:08:46 UTC
Red Hat Product Errata RHSA-2021:4356 0 None None None 2021-11-09 18:22:49 UTC

Description Guilherme de Almeida Suckevicz 2020-11-23 20:30:01 UTC
The Linux kernel for powerpc has an issue with the Run-Time Abstraction Services (RTAS) interface, allowing root (or CAP_SYS_ADMIN users) in a VM to overwrite some parts of memory, including kernel memory.

References:
https://www.openwall.com/lists/oss-security/2020/10/09/1
https://www.openwall.com/lists/oss-security/2020/11/23/2

Upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux.git/commit/?h=next&id=bd59380c5ba4147dcbaad3e582b55ccfd120b764

Comment 1 Guilherme de Almeida Suckevicz 2020-11-23 20:35:36 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1900845]

Comment 2 Justin M. Forbes 2020-11-24 14:03:15 UTC
This was fixed for Fedora with the 5.9 stable kernel rebases.

Comment 3 Petr Matousek 2020-12-10 14:26:47 UTC
Statement:

This issue is rated as having Moderate impact due to the required privileges and hardware dependencies.

Comment 5 Petr Matousek 2020-12-10 14:26:56 UTC
Mitigation:

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Comment 7 Petr Matousek 2020-12-10 14:30:37 UTC
Acknowledgments:

Name: Daniel Axtens (IBM)

Comment 20 errata-xmlrpc 2021-08-31 09:08:42 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2021:3327 https://access.redhat.com/errata/RHSA-2021:3327

Comment 21 Product Security DevOps Team 2021-08-31 11:57:33 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-27777

Comment 22 errata-xmlrpc 2021-11-09 18:22:46 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2021:4356 https://access.redhat.com/errata/RHSA-2021:4356


Note You need to log in before you can comment on or make changes to this bug.