[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Wed, 9 Oct 2019 13:04:30 -0500
From: Tina Li <tli@...italocean.com>
To: bo Zhang <zhangbo5891001@...il.com>
Cc: Vineeth Remanan Pillai <vpillai@...italocean.com>, tiangangpi@...il.com,
oss-security@...ts.openwall.com
Subject: Re: CVE-2019-14835: QEMU-KVM Guest to Host Kernel Escape
Vulnerability: vhost/vhost_net kernel buffer overflow
Hi Bo,
Thanks for your reply.
> This vulnerability is a kernel vul and different verison of Qemu should
> not affect the reproduce. Try the following steps:
>
> 1. The guest kernel patch is for this version:
> Ubuntu-hwe-4.15.0-50.54_16.04.1(
> https://kernel.ubuntu.com/git/ubuntu/ubuntu-xenial.git/tree/drivers/virtio/virtio_ring.c?h=Ubuntu-hwe-4.15.0-50.54_16.04.1),
> if you use different kernel version, the patch may need to be modified
> slightly.
> The patch makes the guest kernel create a invalid descriptor table and the
> echo command is just to trigger the bug through a kernel variable.
>
Our host kernel is 4.15 and it is unpatched. In the guest, we use the
reproducer patch that you provided for Ubuntu-hwe-4.15.0-50.54_16.04.1. But
it doesn't work for us, and it is either crashing the guest or not able to
crash the host during the migration.
1. If we ssh to the guest, and run the echo command to trigger the bug.
Then the guest kernel crashes, even before the modprobe command is executed.
2. If we use the console to access the guest, then we can run echo/modprobe
-r /modprobe commands successfully. But later the live migration is always
successful, and the host is not crashed.
So, as described above, we are not able to reproduce the host crash with
the provided patch because either the guest crashes with the patch or live
migration succeeds when the guest is not crashing.
Would it be possible for you to have another look at the patches that you
used to reproduce and probably post if the patches that you have differs
from the posted one?
Thanks a lot!
Best regards,
Tina
> 2. Ubuntu had released the patched kernel, the host kernel you used should
> not be patched(< 5.2.x) for reproducing the vulnerability.
>
> Thanks!
> cradmin of Tencent Blade Team
>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
