Bug 1828149 (CVE-2020-11884) - CVE-2020-11884 Kernel: s390: page table upgrade in secondary address mode may lead to privilege escalation
Summary: CVE-2020-11884 Kernel: s390: page table upgrade in secondary address mode may...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2020-11884
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: Engineering1828151 Engineering1828152 Engineering1828153 Engineering1828154 1829181
Blocks: Embargoed1826638
TreeView+ depends on / blocked
 
Reported: 2020-04-27 07:23 UTC by Prasad Pandit
Modified: 2021-06-16 02:57 UTC (History)
49 users (show)

Fixed In Version: kernel-5.7
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in the Linux kernel on s390 architecture. The issue occurs on multiprocessing systems when one s390 CPU is in Secondary Address Mode and another CPU does a kernel page table upgrade. An inter-processor interrupt (IPI) is then sent to each active CPU to update the control registers with new page table addresses. In Secondary Address Mode the CPU's CR1 register may hold kernel space address to fetch instructions from, but after IPI processing, the same CR1 register is set to point to a user space address. An unprivileged user or process on the system may use this flaw to crash the system or escalate their privileges on the system. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.
Clone Of:
Environment:
Last Closed: 2020-05-12 16:32:31 UTC

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2020:2172 0 None None None 2020-05-18 01:01:28 UTC
Red Hat Product Errata RHBA-2020:2173 0 None None None 2020-05-18 02:22:20 UTC
Red Hat Product Errata RHBA-2020:2578 0 None None None 2020-06-16 11:55:44 UTC
Red Hat Product Errata RHSA-2020:2102 0 None None None 2020-05-12 15:27:13 UTC
Red Hat Product Errata RHSA-2020:2199 0 None None None 2020-05-19 12:38:10 UTC
Red Hat Product Errata RHSA-2020:2429 0 None None None 2020-06-09 18:45:06 UTC

Description Prasad Pandit 2020-04-27 07:23:59 UTC 
An issue was found in the way Linux kernel on s390 architecture upgrades page table and updates corresponding addresses in CPU's control registers. The issue occurs on multiprocessing system, when one s390 CPU is in Secondary Address Mode and another CPU does kernel page table upgrade. It leads to Inter Processor Interrupts (IPI) being sent to each active CPU, for it to update its control register(s) with new page table address(es). In the Secondary Address Mode, CPU's CR1 register may hold kernel space address to fetch instruction from. But after the IPI processing, the same CR1 register is set to point to a user space address.

An unprivileged user/process on s390 system may use this flaw to crash the system resulting in DoS OR potentially escalate privileges on the system.

Upstream patch:
---------------
  -> https://git.kernel.org/linus/316ec154810960052d4586b634156c54d0778f74
Comment 5 Prasad Pandit 2020-04-27 11:02:37 UTC 
Acknowledgments:

Name: Christian Borntraeger (IBM)
Comment 6 Eric Christensen 2020-04-27 16:24:53 UTC 
Statement:

This issue does not affect the versions of the kernel package as shipped with the Red Hat Enterprise Linux 5, 6, 7, and Red Hat Enterprise MRG 2.

This issue affects the versions of the kernel package as shipped with the Red Hat Enterprise Linux 8. Future kernel updates for the Red Hat Enterprise Linux 8 may address this issue.
Comment 8 Prasad Pandit 2020-04-29 06:56:37 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1829181]
Comment 9 Eric Christensen 2020-05-01 17:49:03 UTC 
Mitigation:

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Comment 10 errata-xmlrpc 2020-05-12 15:27:10 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2020:2102 https://access.redhat.com/errata/RHSA-2020:2102
Comment 11 Product Security DevOps Team 2020-05-12 16:32:31 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-11884
Comment 13 errata-xmlrpc 2020-05-19 12:38:03 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Extended Update Support

Via RHSA-2020:2199 https://access.redhat.com/errata/RHSA-2020:2199
Comment 14 errata-xmlrpc 2020-06-09 18:45:04 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.0 Update Services for SAP Solutions

Via RHSA-2020:2429 https://access.redhat.com/errata/RHSA-2020:2429
Note You need to log in before you can comment on or make changes to this bug.