Bug 1031702 (CVE-2013-4592) - CVE-2013-4592 kernel: kvm: memory leak when memory slot is moved with assigned device
Summary: CVE-2013-4592 kernel: kvm: memory leak when memory slot is moved with assigne...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2013-4592
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 978472
Blocks: 1031705
TreeView+ depends on / blocked
 
Reported: 2013-11-18 15:10 UTC by Petr Matousek
Modified: 2021-10-20 10:42 UTC (History)
28 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2021-10-20 10:42:21 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2013:1645 0 normal SHIPPED_LIVE Important: Red Hat Enterprise Linux 6 kernel update 2013-11-20 22:04:18 UTC

Description Petr Matousek 2013-11-18 15:10:11 UTC 
When a user memory slot is moved (ie. the base_gfn changes), iommu pages are neither unpinned nor unmapped.  The memory for these pages then cannot be recovered without rebooting the system.

Local user with ability to assign device (with access to PCI sysfs files for a device) could use this flaw to DoS the system.

Upstream fixes:
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=12d6e7538e2d418c08f082b1b44ffa5fb7270ed8
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e40f193f5bb022e927a57a4f5d5194e4f12ddb74
Comment 1 errata-xmlrpc 2013-11-21 20:37:15 UTC 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 6

Via RHSA-2013:1645 https://rhn.redhat.com/errata/RHSA-2013-1645.html
Note You need to log in before you can comment on or make changes to this bug.