[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    Re: [oss-security] kernel: kvm: pit timer with no irqchip crashes
From:       Kurt Seifried <kseifried () redhat ! com>
Date:       2011-12-21 22:20:14
Message-ID: 4EF25B9E.3060606 () redhat ! com
[Download RAW message or body]

On 12/21/2011 03:14 PM, Petr Matousek wrote:
> Sorry, I forgot to put "CVE Request" into the subject.
>
> Petr
>
> On Wed, Dec 21, 2011 at 11:12:10PM +0100, Petr Matousek wrote:
>> User space may create the PIT and forget about setting up the irqchips.
>> In that case, firing PIT IRQs will crash the host:
>>
>> BUG: unable to handle kernel NULL pointer dereference at
>> 0000000000000128
>> IP: [<ffffffffa10f6280>] kvm_set_irq+0x30/0x170 [kvm]
>> ...
>> Call Trace:
>>   [<ffffffffa11228c1>] pit_do_work+0x51/0xd0 [kvm]
>>   [<ffffffff81071431>] process_one_work+0x111/0x4d0
>>   [<ffffffff81071bb2>] worker_thread+0x152/0x340
>>   [<ffffffff81075c8e>] kthread+0x7e/0x90
>>   [<ffffffff815a4474>] kernel_thread_helper+0x4/0x10
>>
>> Reference:
>> http://permalink.gmane.org/gmane.comp.emulators.kvm.devel/83564
>> https://bugzilla.redhat.com/show_bug.cgi?id=769721
>>
>> Thanks,
>> -- 
>> Petr Matousek / Red Hat Security Response Team
Please use CVE-2011-4622 for this issue.

-- 

-Kurt Seifried / Red Hat Security Response Team

[prev in list] [next in list] [prev in thread] [next in thread]