oss-security - Re: kernel: kvm: pit timer with no irqchip crashes the system

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Wed, 21 Dec 2011 15:20:14 -0700
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: kernel: kvm: pit timer with no irqchip crashes
 the system

On 12/21/2011 03:14 PM, Petr Matousek wrote:
> Sorry, I forgot to put "CVE Request" into the subject.
>
> Petr
>
> On Wed, Dec 21, 2011 at 11:12:10PM +0100, Petr Matousek wrote:
>> User space may create the PIT and forget about setting up the irqchips.
>> In that case, firing PIT IRQs will crash the host:
>>
>> BUG: unable to handle kernel NULL pointer dereference at
>> 0000000000000128
>> IP: [<ffffffffa10f6280>] kvm_set_irq+0x30/0x170 [kvm]
>> ...
>> Call Trace:
>>   [<ffffffffa11228c1>] pit_do_work+0x51/0xd0 [kvm]
>>   [<ffffffff81071431>] process_one_work+0x111/0x4d0
>>   [<ffffffff81071bb2>] worker_thread+0x152/0x340
>>   [<ffffffff81075c8e>] kthread+0x7e/0x90
>>   [<ffffffff815a4474>] kernel_thread_helper+0x4/0x10
>>
>> Reference:
>> http://permalink.gmane.org/gmane.comp.emulators.kvm.devel/83564
>> https://bugzilla.redhat.com/show_bug.cgi?id=769721
>>
>> Thanks,
>> -- 
>> Petr Matousek / Red Hat Security Response Team
Please use CVE-2011-4622 for this issue.

-- 

-Kurt Seifried / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.