Linux Kernel 4.8 on Power8 KVM kvmppc_save_tm/kvmppc_restore_tm Parameter race condition

Summaryinfo

A vulnerability categorized as problematic has been discovered in Linux Kernel 4.8 on Power8. The impacted element is the function kvmppc_save_tm/kvmppc_restore_tm of the component KVM. Executing a manipulation as part of Parameter can lead to race condition. This vulnerability appears as CVE-2020-8834. The attack requires local access. There is no available exploit.

Detailsinfo

A vulnerability classified as critical was found in Linux Kernel 4.8 on Power8 (Operating System). This vulnerability affects the function kvmppc_save_tm/kvmppc_restore_tm of the component KVM. The manipulation as part of a Parameter leads to a race condition vulnerability. The CWE definition for the vulnerability is CWE-368. A product performs a series of non-atomic actions to switch between contexts that cross privilege or other security boundaries, but a race condition allows an attacker to modify or misrepresent the product's behavior during the switch. As an impact it is known to affect availability. CVE summarizes:

KVM in the Linux kernel on Power8 processors has a conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry plus in kvmppc_{save,restore}_tm, leading to a stack corruption. Because of this, an attacker with the ability run code in kernel space of a guest VM can cause the host kernel to panic. There were two commits that, according to the reporter, introduced the vulnerability: f024ee098476 ("KVM: PPC: Book3S HV: Pull out TM state save/restore into separate procedures") 87a11bb6a7f7 ("KVM: PPC: Book3S HV: Work around XER[SO] bug in fake suspend mode") The former landed in 4.8, the latter in 4.17. This was fixed without realizing the impact in 4.18 with the following three commits, though it's believed the first is the only strictly necessary commit: 6f597c6b63b6 ("KVM: PPC: Book3S PR: Add guest MSR parameter for kvmppc_save_tm()/kvmppc_restore_tm()") 7b0e827c6970 ("KVM: PPC: Book3S HV: Factor fake-suspend handling out of kvmppc_save/restore_tm") 009c872a8bc4 ("KVM: PPC: Book3S PR: Move kvmppc_save_tm/kvmppc_restore_tm to separate file")

The weakness was presented 04/09/2020. This vulnerability was named CVE-2020-8834 since 02/10/2020. The attack needs to be approached locally. The successful exploitation needs a single authentication. There are known technical details, but no exploit is available.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

See VDB-153032 and VDB-153027 for similar entries. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 4.8

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion