Date: Thu, 19 Apr 2012 12:52:05 +0200 From: Petr Matousek <pmatouse@...hat.com> To: oss-security@...ts.openwall.com Subject: CVE request -- kernel: kvm: device assignment page leak KVM uses memory slots to track and map guest regions of memory. When device assignment is used, the pages backing these slots are pinned in memory using get_user_pages and mapped into the iommu. The problem is that when a memory slot is destroyed the pages for the associated memory slot are neither unpinned nor unmapped from the iommu. The problem is that those pages are now never unpinned and continue to have an increased reference count. This is therefore a potential page leak from the kvm kernel module. On Red Hat Enterprise Linux, local user with ability to assign devices could use this flaw to DoS the system. With upstream qemu-kvm/kvm privileged guest user that could hotunplug and then hotplug back certain devices could potentially use this flaw to DoS the host. Upstream fix: http://git.kernel.org/?p=virt/kvm/kvm.git;a=commit;h=32f6daad4651a748a58a3ab6da0611862175722f References: https://lkml.org/lkml/2012/4/11/248 https://bugzilla.redhat.com/show_bug.cgi?id=814149 Thanks, -- Petr Matousek / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.