Bug 308811 (CVE-2007-3850) - CVE-2007-3850 kernel LTC31426-4k page mapping support for userspace in 64k kernels
Summary: CVE-2007-3850 kernel LTC31426-4k page mapping support for userspace in 64k ke...
Alias: CVE-2007-3850
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: ppc64
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Whiteboard: impact=moderate,source=redhat,reporte...
Keywords: Security
Depends On: 250144 275841
TreeView+ depends on / blocked
Reported: 2007-09-27 12:12 UTC by Mark J. Cox
Modified: 2019-06-08 12:23 UTC (History)
9 users (show)

Clone Of:
Last Closed: 2008-01-17 15:38:26 UTC

Attachments (Terms of Use)

External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2007:0940 normal SHIPPED_LIVE Important: kernel security update 2007-10-22 10:52:41 UTC

Description Mark J. Cox 2007-09-27 12:12:34 UTC
The eHCA driver has a problem with mapping userspace resources.  It's nicely
explained in the upstream git submission:
Some drivers have resources that they want to be able to map into
userspace that are 4k in size.	On a kernel configured with 64k pages
we currently end up mapping the 4k we want plus another 60k of
physical address space, which could contain anything.  This can
introduce security problems, for example in the case of an infiniband
adaptor where the other 60k could contain registers that some other
program is using for its communications.

Upstream patch:
and commit:

galaxy has a 4k page of control registers for each single QP and CQ.
The physical adress of this page is defined by phyp when you allocate a resource.

To be able to send and receive data from userspace without a kernel call you
have to get access to that 4k page from userspace.
If the linux kernel only allows to map 64k pages into userspace there's a
conflict. Phyp only allows to map this page area in 4k chunks (H_ENTER).

* a flaw in the eHCA driver on PowerPC architectures that allowed a local
user to access 60k of physical address space.

Comment 3 Red Hat Product Security 2008-01-17 15:38:26 UTC
This issue was addressed in:

Red Hat Enterprise Linux:

Note You need to log in before you can comment on or make changes to this bug.