Bug 1647573 (CVE-2018-19961, CVE-2018-19962) - CVE-2018-19961 CVE-2018-19962 xen: insufficient TLB flushing / improper large page mappings with AMD IOMMUs
Summary: CVE-2018-19961 CVE-2018-19962 xen: insufficient TLB flushing / improper large...
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2018-19961, CVE-2018-19962
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1651665
Blocks: 1647577
TreeView+ depends on / blocked
 
Reported: 2018-11-07 19:59 UTC by Laura Pardo
Modified: 2021-02-16 22:47 UTC (History)
22 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-11-08 16:23:08 UTC
Embargoed:

Attachments (Terms of Use)

Description Laura Pardo 2018-11-07 19:59:54 UTC 
A flaw was found in xen. In order to be certain that no undue access to memory is possible anymore after IOMMU mappings of this memory have been removed, Translation Lookaside Buffers (TLBs) need to be flushed after most changes to such mappings. Xen bypassed certain IOMMU flushes on AMD
x86 hardware. Furthermore logic exists Xen to re-combine small page mappings into larger ones. Such re-combination could have occured in cases when it was not really safe/correct to do so.
Comment 1 Andrej Nemec 2018-11-20 14:11:40 UTC 
References:

https://seclists.org/oss-sec/2018/q4/154
Comment 2 Andrej Nemec 2018-11-20 14:11:52 UTC 
Acknowledgments:

Name: the Xen project
Comment 3 Andrej Nemec 2018-11-20 14:13:07 UTC 
Created xen tracking bugs for this issue:

Affects: fedora-all [bug 1651665]
Note You need to log in before you can comment on or make changes to this bug.