Bug 308811 (CVE-2007-3850) - CVE-2007-3850 kernel LTC31426-4k page mapping support for userspace in 64k kernels
Summary: CVE-2007-3850 kernel LTC31426-4k page mapping support for userspace in 64k ke...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2007-3850
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: ppc64
OS: Linux
urgent
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 250144 275841
Blocks:
TreeView+ depends on / blocked
 
Reported: 2007-09-27 12:12 UTC by Mark J. Cox
Modified: 2019-09-29 12:21 UTC (History)
9 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2008-01-17 15:38:26 UTC
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2007:0940 0 normal SHIPPED_LIVE Important: kernel security update 2007-10-22 10:52:41 UTC

Description Mark J. Cox 2007-09-27 12:12:34 UTC
The eHCA driver has a problem with mapping userspace resources.  It's nicely
explained in the upstream git submission:
Some drivers have resources that they want to be able to map into
userspace that are 4k in size.	On a kernel configured with 64k pages
we currently end up mapping the 4k we want plus another 60k of
physical address space, which could contain anything.  This can
introduce security problems, for example in the case of an infiniband
adaptor where the other 60k could contain registers that some other
program is using for its communications.

Upstream patch:
http://patchwork.ozlabs.org/linuxppc/patch?id=10281
and commit:
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=721151d004dcf01a71b12bb6b893f9160284cf6e

galaxy has a 4k page of control registers for each single QP and CQ.
The physical adress of this page is defined by phyp when you allocate a resource.

To be able to send and receive data from userspace without a kernel call you
have to get access to that 4k page from userspace.
If the linux kernel only allows to map 64k pages into userspace there's a
conflict. Phyp only allows to map this page area in 4k chunks (H_ENTER).

* a flaw in the eHCA driver on PowerPC architectures that allowed a local
user to access 60k of physical address space.

Comment 3 Red Hat Product Security 2008-01-17 15:38:26 UTC
This issue was addressed in:

Red Hat Enterprise Linux:
  http://rhn.redhat.com/errata/RHSA-2007-0940.html




Note You need to log in before you can comment on or make changes to this bug.