Date: Wed, 9 Oct 2019 13:04:30 -0500 From: Tina Li <tli@...italocean.com> To: bo Zhang <zhangbo5891001@...il.com> Cc: Vineeth Remanan Pillai <vpillai@...italocean.com>, tiangangpi@...il.com, oss-security@...ts.openwall.com Subject: Re: CVE-2019-14835: QEMU-KVM Guest to Host Kernel Escape Vulnerability: vhost/vhost_net kernel buffer overflow Hi Bo, Thanks for your reply. > This vulnerability is a kernel vul and different verison of Qemu should > not affect the reproduce. Try the following steps: > > 1. The guest kernel patch is for this version: > Ubuntu-hwe-4.15.0-50.54_16.04.1( > https://kernel.ubuntu.com/git/ubuntu/ubuntu-xenial.git/tree/drivers/virtio/virtio_ring.c?h=Ubuntu-hwe-4.15.0-50.54_16.04.1), > if you use different kernel version, the patch may need to be modified > slightly. > The patch makes the guest kernel create a invalid descriptor table and the > echo command is just to trigger the bug through a kernel variable. > Our host kernel is 4.15 and it is unpatched. In the guest, we use the reproducer patch that you provided for Ubuntu-hwe-4.15.0-50.54_16.04.1. But it doesn't work for us, and it is either crashing the guest or not able to crash the host during the migration. 1. If we ssh to the guest, and run the echo command to trigger the bug. Then the guest kernel crashes, even before the modprobe command is executed. 2. If we use the console to access the guest, then we can run echo/modprobe -r /modprobe commands successfully. But later the live migration is always successful, and the host is not crashed. So, as described above, we are not able to reproduce the host crash with the provided patch because either the guest crashes with the patch or live migration succeeds when the guest is not crashing. Would it be possible for you to have another look at the patches that you used to reproduce and probably post if the patches that you have differs from the posted one? Thanks a lot! Best regards, Tina > 2. Ubuntu had released the patched kernel, the host kernel you used should > not be patched(< 5.2.x) for reproducing the vulnerability. > > Thanks! > cradmin of Tencent Blade Team >
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.