Bug 1710405 (CVE-2019-11085) - CVE-2019-11085 kernel: insufficient input validation in kernel mode driver in Intel i915 graphics leads to privilege escalation
Summary: CVE-2019-11085 kernel: insufficient input validation in kernel mode driver in...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2019-11085
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1710406 Engineering1713554 Engineering1713566 Engineering1713567 Engineering1713568 Engineering1713569 Engineering1713570 Engineering1713571 Engineering1713572 Engineering1713573 Engineering1713574 Engineering1739309 Engineering1782082 Engineering1782083 Engineering1782084
Blocks: Embargoed1710418
TreeView+ depends on / blocked
 
Reported: 2019-05-15 13:57 UTC by msiddiqu
Modified: 2023-03-24 14:48 UTC (History)
44 users (show)

Fixed In Version: kernel 5.0
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the Linux kernel's implementation of GVT-g which allowed an attacker with access to a 'passed through' Intel i915 graphics card to possibly access resources allocated to other virtual machines, crash the host, or possibly corrupt memory leading to privilege escalation.
Clone Of:
Environment:
Last Closed: 2019-07-29 19:18:39 UTC

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2019:1977 0 None None None 2019-07-30 14:16:05 UTC
Red Hat Product Errata RHBA-2019:1978 0 None None None 2019-07-30 14:16:36 UTC
Red Hat Product Errata RHSA-2019:1873 0 None None None 2019-07-29 15:14:32 UTC
Red Hat Product Errata RHSA-2019:1891 0 None None None 2019-07-29 15:15:45 UTC
Red Hat Product Errata RHSA-2019:1959 0 None None None 2019-07-30 09:42:24 UTC
Red Hat Product Errata RHSA-2019:1971 0 None None None 2019-07-30 11:02:16 UTC
Red Hat Product Errata RHSA-2020:0543 0 None None None 2020-02-18 14:43:42 UTC
Red Hat Product Errata RHSA-2020:0592 0 None None None 2020-02-25 12:10:56 UTC
Red Hat Product Errata RHSA-2020:0609 0 None None None 2020-02-26 09:16:09 UTC

Description msiddiqu 2019-05-15 13:57:09 UTC 
A flaw was found in the Linux kernels implementation of i1915 kvm passthrough.
Systems configured with "Intel i915 graphics cards" passthrough for kvm guests suffer from a flaw in the kernel may allow a KVM guest to be able to crash the system or potentially enable priviledge escalation on the host.


Upstream patch:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/drivers/gpu/drm/i915/gvt/kvmgt.c?id=51b00d8509dc69c98740da2ad07308b630d3eb7d
Comment 1 msiddiqu 2019-05-15 13:57:26 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1710406]
Comment 2 msiddiqu 2019-05-15 14:01:49 UTC 
External References:

https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00249.html
Comment 3 Justin M. Forbes 2019-05-15 21:18:11 UTC 
This was fixed for Fedora with the 5.0 series stable rebase.
Comment 7 Wade Mealing 2019-05-24 08:01:51 UTC 
Notes:

:- This only affects users who have configured i915 device passthrough.
:- i915 passthrough is NOT default for virtual guests configured.
:- admins will likely need to explicitly configure this passthrough for use.
:- I can't see how the exploitable code gets called if you have no kvm-passthrough configured.

Blacklisting the kvmgt.ko kernel module may prevent the exploitable code from loading, but it will
also stop the passthrough feature for i915 devices from working correctly.
Comment 10 Wade Mealing 2019-05-27 02:20:20 UTC 
I choose to rate this as IMPORTANT fix for those customers who are affected.  There is a very good chance that most people using virtualization do NOT pass through the i915 hardware but for those that have, this should be fixed.
Comment 12 errata-xmlrpc 2019-07-29 15:14:29 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:1873 https://access.redhat.com/errata/RHSA-2019:1873
Comment 13 errata-xmlrpc 2019-07-29 15:15:41 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:1891 https://access.redhat.com/errata/RHSA-2019:1891
Comment 14 Product Security DevOps Team 2019-07-29 19:18:39 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2019-11085
Comment 15 errata-xmlrpc 2019-07-30 09:42:22 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:1959 https://access.redhat.com/errata/RHSA-2019:1959
Comment 16 errata-xmlrpc 2019-07-30 11:02:14 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2019:1971 https://access.redhat.com/errata/RHSA-2019:1971
Comment 30 errata-xmlrpc 2020-02-18 14:43:38 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.5 Extended Update Support

Via RHSA-2020:0543 https://access.redhat.com/errata/RHSA-2020:0543
Comment 31 errata-xmlrpc 2020-02-25 12:10:48 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.4 Advanced Update Support
  Red Hat Enterprise Linux 7.4 Update Services for SAP Solutions
  Red Hat Enterprise Linux 7.4 Telco Extended Update Support

Via RHSA-2020:0592 https://access.redhat.com/errata/RHSA-2020:0592
Comment 32 errata-xmlrpc 2020-02-26 09:16:05 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise MRG 2

Via RHSA-2020:0609 https://access.redhat.com/errata/RHSA-2020:0609
Note You need to log in before you can comment on or make changes to this bug.