Date: Mon, 29 Oct 2018 16:11:34 +0100 From: Jann Horn <jannh@...gle.com> To: oss-security@...ts.openwall.com Subject: Linux kernel: TLB flush happens too late on mremap (CVE-2018-18281; fixed in 4.9.135, 4.14.78, 4.18.16, 4.19) NOTE: I have requested a CVE identifier, and I'm sending this message, to make tracking of the fix easier; however, to avoid missing security fixes without CVE identifiers, you should *NOT* be cherry-picking a specific patch in response to a notification about a kernel security bug. Since Linux kernel version 3.2, the mremap() syscall performs TLB flushes after dropping pagetable locks. If a syscall such as ftruncate() removes entries from the pagetables of a task that is in the middle of mremap(), a stale TLB entry can remain for a short time that permits access to a physical page after it has been released back to the page allocator and reused. This is CVE-2018-18281. This is fixed in the following kernel versions: 4.9.135 4.14.78 4.18.16 4.19 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=eb66ae030829605d61fbef1909ce310e29f78821 https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.135 https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.78 https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.18.16 https://bugs.chromium.org/p/project-zero/issues/detail?id=1695
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.