Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 19 Apr 2012 12:52:05 +0200
From: Petr Matousek <pmatouse@...hat.com>
To: oss-security@...ts.openwall.com
Subject: CVE request -- kernel: kvm: device assignment page leak

KVM uses memory slots to track and map guest regions of memory.  When
device assignment is used, the pages backing these slots are pinned in
memory using get_user_pages and mapped into the iommu.  The problem is
that when a memory slot is destroyed the pages for the associated memory
slot are neither unpinned nor unmapped from the iommu.

The problem is that those pages are now never unpinned and continue to
have an increased reference count.  This is therefore a potential page
leak from the kvm kernel module.

On Red Hat Enterprise Linux, local user with ability to assign devices
could use this flaw to DoS the system.

With upstream qemu-kvm/kvm privileged guest user that could hotunplug
and then hotplug back certain devices could potentially use this flaw to
DoS the host.

Upstream fix:
http://git.kernel.org/?p=virt/kvm/kvm.git;a=commit;h=32f6daad4651a748a58a3ab6da0611862175722f

References:
https://lkml.org/lkml/2012/4/11/248
https://bugzilla.redhat.com/show_bug.cgi?id=814149

Thanks,
-- 
Petr Matousek / Red Hat Security Response Team

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.