Bug 308811 - (CVE-2007-3850) CVE-2007-3850 kernel LTC31426-4k page mapping support for userspace in 64k kernels
CVE-2007-3850 kernel LTC31426-4k page mapping support for userspace in 64k ke...
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
ppc64 Linux
urgent Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
: Security
Depends On: 250144 275841
  Show dependency treegraph
Reported: 2007-09-27 08:12 EDT by Mark J. Cox (Product Security)
Modified: 2008-01-17 10:38 EST (History)
9 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2008-01-17 10:38:26 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

  None (edit)
Description Mark J. Cox (Product Security) 2007-09-27 08:12:34 EDT
The eHCA driver has a problem with mapping userspace resources.  It's nicely
explained in the upstream git submission:
Some drivers have resources that they want to be able to map into
userspace that are 4k in size.	On a kernel configured with 64k pages
we currently end up mapping the 4k we want plus another 60k of
physical address space, which could contain anything.  This can
introduce security problems, for example in the case of an infiniband
adaptor where the other 60k could contain registers that some other
program is using for its communications.

Upstream patch:
and commit:

galaxy has a 4k page of control registers for each single QP and CQ.
The physical adress of this page is defined by phyp when you allocate a resource.

To be able to send and receive data from userspace without a kernel call you
have to get access to that 4k page from userspace.
If the linux kernel only allows to map 64k pages into userspace there's a
conflict. Phyp only allows to map this page area in 4k chunks (H_ENTER).

* a flaw in the eHCA driver on PowerPC architectures that allowed a local
user to access 60k of physical address space.
Comment 3 Red Hat Product Security 2008-01-17 10:38:26 EST
This issue was addressed in:

Red Hat Enterprise Linux:

Note You need to log in before you can comment on or make changes to this bug.