Date: Mon, 14 Sep 2015 15:37:07 -0400 (EDT) From: cve-assign@...re.org To: oss-security@...ts.openwall.com Cc: cve-assign@...re.org Subject: Re: CVE Request: Linux x86_64 NT flag issue - Linux kernel -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 >> Use CVE-2015-6666. > I think this may be a false alarm. SDM Volume 3 22.214.171.124 says: > > On calls to exception and interrupt handlers, the processor also > clears the VM, RF, and NT flags in the EFLAGS register, after > they are saved on the stack. > > So if an interrupt or page fault happened while NT was incorrectly > set, the NT flag would still be clear when context switching and would > therefore never leak. (This wouldn't have been the case before 3.19, > when we could context switch by calling schedule() directly while NT > was set, but those kernels manually saved and restored flags across > context switches.) We have not seen any further discussion of this. Our understanding is that this "might be able to leak NT into an unrelated task" security impact was not found to affect any version of the Linux kernel. Unless there is other information, we will move CVE-2015-6666 into the "rejected" state later this week. - -- CVE assignment team, MITRE CVE Numbering Authority M/S M300 202 Burlington Road, Bedford, MA 01730 USA [ PGP key available through http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCAAGBQJV9x+yAAoJEL54rhJi8gl517kP/0veNuawDhSguGeXOrtzKv/k d6+CJJZq4YUUAhOJ5ZdWL0TeLqN0FRaDsAhcs6SgmCNjKTWtq4diZcGPI3dElNfC bLjmrsvJ3cWF2mk1JRUHgLhOnNj4pCOTbLQGknKKORZbBV3nH55WZhLNicqahkJL qrUnPC05yRxI/xHmKLWu8Ic7W4s2jhz74F1se64t5qgdlekhQc9VqrXMvuzJhq+t SAODGrf6c4fwjhhPT/XPXDq2aqa0wGkvF4usS8Kxgp2g6cBuH39UZ54e5istzV79 v1k8lwS+AnG6/W7od8sVzE3QahRr/ia7EDnurvUEC9AbkLF7qWr2+zhkvgsbx9UU r6jPWpQbNkrZMZdVEH3lwDNsMGOiuB6E1W+2BTXJB+HSo/4IBd8JuF9JOP07E3ye p5hb5u34P/WSXa3D+B3HukRB5aYK3KnoY0F9Fu0RT/f/v/OFZnwzyfrmAzLGI44c dlw3kjQXEayFi8V6816YODZnKQHk4z2EwvrK7Jeu0bP1wnn/xvToWapVVLIaQ0wK ojsATC/5KxLTJzc888++/aIlgpomGlmDBZVgpEImAc9Hr50V3gm5u1QZeAcGy4h6 Um6f1USBtnmDiebA8N2ITF3Vh55AzsmyX2vRKg382soaw8TKWVygXLwLrPE/1VXh PvwowWLecM0VCnO6nqoT =N5KU -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ