Bug 1335817 (CVE-2014-8181) - CVE-2014-8181 kernel: scsi: do not fill dirty page content in the SG_IO buffer
Summary: CVE-2014-8181 kernel: scsi: do not fill dirty page content in the SG_IO buffer
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2014-8181
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 1172251
TreeView+ depends on / blocked
 
Reported: 2016-05-13 09:41 UTC by Vladis Dronov
Modified: 2019-09-29 13:49 UTC (History)
33 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-05-13 09:47:28 UTC


Attachments (Terms of Use)

Description Vladis Dronov 2016-05-13 09:41:06 UTC
In sg_io, blk_rq_map_user{,_iov} may allocate a set of bounce buffer
pages to do the bio, if it finds the user buffer cannot be directly
mapped. But the allocated pages are not cleared.

If the bounce buffer is also not written to by device, garbage data is
left, and copied back to user in blk_rq_unmap_user.

The allocated pages should be cleared. This also eliminates the risk
of leaking sensitive information to userspace, which may have a security
impact.

This flaw is specific to RHEL-7 and does not affect the current upstream kernel.

Comment 1 Vladis Dronov 2016-05-13 09:41:36 UTC
Acknowledgments:

Name: Fam Zheng (Red Hat)

Comment 2 Vladis Dronov 2016-05-13 09:47:28 UTC
Statement:

This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5,6.

This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 7 and MRG-2. This has been rated as having Low security impact as exploiting it requires privileged access and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.


Note You need to log in before you can comment on or make changes to this bug.