[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Thu, 19 Apr 2012 09:36:23 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request -- kernel: kvm: device assignment
page leak
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On 04/19/2012 04:52 AM, Petr Matousek wrote:
> KVM uses memory slots to track and map guest regions of memory.
> When device assignment is used, the pages backing these slots are
> pinned in memory using get_user_pages and mapped into the iommu.
> The problem is that when a memory slot is destroyed the pages for
> the associated memory slot are neither unpinned nor unmapped from
> the iommu.
>
> The problem is that those pages are now never unpinned and continue
> to have an increased reference count. This is therefore a
> potential page leak from the kvm kernel module.
>
> On Red Hat Enterprise Linux, local user with ability to assign
> devices could use this flaw to DoS the system.
>
> With upstream qemu-kvm/kvm privileged guest user that could
> hotunplug and then hotplug back certain devices could potentially
> use this flaw to DoS the host.
>
> Upstream fix:
> http://git.kernel.org/?p=virt/kvm/kvm.git;a=commit;h=32f6daad4651a748a58a3ab6da0611862175722f
>
> References: https://lkml.org/lkml/2012/4/11/248
> https://bugzilla.redhat.com/show_bug.cgi?id=814149
>
> Thanks,
Please use CVE-2012-2121 for this issue.
- --
Kurt Seifried Red Hat Security Response Team (SRT)
PGP: 0x5E267993 A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
iQIcBAEBAgAGBQJPkDD3AAoJEBYNRVNeJnmTcgYP/2ubexk0a17sSaRyOV/o+ZUY
17YhJVMWWfoXeI0fIjxU/WI/E5eE0GjaZh8wcHzok+SPFiNo8brKberOhOy9YqDE
DMDT7fO0MTEBNx9szJP7Etjlz2yQVfDKUIyn5M6o9oviWxHDQkSA/hXPZ5RsxBL0
8MVWrVtLMKvNM05jJBSuu+NGiUv4NcHGHMYB6OTmzAdfYgKnSCTnk+cM2iXdmi/g
zYh3R7jdwN6EJvEVJFEFDTPY70g15wyQA4+uWBcR/tXb5q9gMMrAKE/JaBJRDe7I
uXeFVjbBlWz30c8s5mvScI3PkuUIDXw053lZBf/VpxPuJpTRTlA4ikORSUTrrF3t
lZFAkl2g5QzpVPjsSgZEDp6jHa/ZUNu8qVW2JX4NVcci3dOu/dvOFcppsXOHPVWv
firw9TtXQctDKMjjEB4FPdWJtd3oP3DAYwMFoEAUfcbRgtNv7W9p0XCinnoisbCg
P5wPw4SC3EIx2p4keNY801GwEusuZCPBPOcuc2sh5pcbhSmuXZK/KHLc1U9qU9mJ
QgqXbCDVg88TTA5gjn6+RTp2W9J7SGXEv685jtBl0EyTLmgyehOttIjUxB5kgyS1
Kcmw3JSvoziEn8n00N1m4VfAFfLLYVlzdv7L92HOPUAeky0cBKZVTgo0kJ9c/r6R
+z43QEIoqBzG8777rFQP
=hZGt
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
