[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <20120419105204.GE29881@dhcp-25-225.brq.redhat.com>
Date: Thu, 19 Apr 2012 12:52:05 +0200
From: Petr Matousek <pmatouse@...hat.com>
To: oss-security@...ts.openwall.com
Subject: CVE request -- kernel: kvm: device assignment page leak
KVM uses memory slots to track and map guest regions of memory. When
device assignment is used, the pages backing these slots are pinned in
memory using get_user_pages and mapped into the iommu. The problem is
that when a memory slot is destroyed the pages for the associated memory
slot are neither unpinned nor unmapped from the iommu.
The problem is that those pages are now never unpinned and continue to
have an increased reference count. This is therefore a potential page
leak from the kvm kernel module.
On Red Hat Enterprise Linux, local user with ability to assign devices
could use this flaw to DoS the system.
With upstream qemu-kvm/kvm privileged guest user that could hotunplug
and then hotplug back certain devices could potentially use this flaw to
DoS the host.
Upstream fix:
http://git.kernel.org/?p=virt/kvm/kvm.git;a=commit;h=32f6daad4651a748a58a3ab6da0611862175722f
References:
https://lkml.org/lkml/2012/4/11/248
https://bugzilla.redhat.com/show_bug.cgi?id=814149
Thanks,
--
Petr Matousek / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
