Bug 803793 - (CVE-2012-1179) CVE-2012-1179 kernel: thp:__split_huge_page() mapcount != page_mapcount BUG_ON()
CVE-2012-1179 kernel: thp:__split_huge_page() mapcount != page_mapcount BUG_ON()
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20120315,repor...
: Security
Depends On: 1188485 800328 803808 803809 823612 1188486 1188487 1188488
Blocks: 802633
  Show dependency treegraph
 
Reported: 2012-03-15 12:36 EDT by Petr Matousek
Modified: 2015-02-16 10:48 EST (History)
21 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-08-24 08:26:33 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Petr Matousek 2012-03-15 12:36:45 EDT
In some cases it may happen that pmd_none_or_clear_bad() is called
with the mmap_sem hold in read mode. In those cases the huge page
faults can allocate hugepmds under pmd_none_or_clear_bad() and that
can trigger a false positive from pmd_bad() that will not like to see
a pmd materializing as trans huge.

A privileged user in the KVM guest can use this flaw to crash the host.
An unprivileged local user could use this flaw to crash the system.

Proposed upstream patch:
http://comments.gmane.org/gmane.linux.kernel.mm/75413
Comment 2 Petr Matousek 2012-03-15 12:57:20 EDT
Created kernel tracking bugs for this issue

Affects: fedora-all [bug 803809]
Comment 4 Fedora Update System 2012-03-17 19:58:33 EDT
kernel-3.2.10-3.fc16 has been pushed to the Fedora 16 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 5 Fedora Update System 2012-03-26 14:02:11 EDT
kernel-2.6.42.12-1.fc15 has been pushed to the Fedora 15 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 8 errata-xmlrpc 2012-06-18 09:33:45 EDT
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2012:0743 https://rhn.redhat.com/errata/RHSA-2012-0743.html
Comment 9 errata-xmlrpc 2012-06-26 14:43:36 EDT
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6.1 EUS - Server Only

Via RHSA-2012:1042 https://rhn.redhat.com/errata/RHSA-2012-1042.html

Note You need to log in before you can comment on or make changes to this bug.