[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    [oss-security] CVE-2019-3016: information leak within a KVM guest
From:       John Haxby <john.haxby () oracle ! com>
Date:       2020-01-30 18:00:03
Message-ID: 7151FEEF-4905-4333-8F4A-8B46AEC36E07 () oracle ! com
[Download RAW message or body]

[Attachment #2 (multipart/mixed)]


The problem is missing TLB flushes which potentially allows a process in a KVM guest to access \
memory locations within that guest that it should not have access to.

The problem is limited to host kernels 4.10 onwards with guest kernels running 4.16 onwards and \
PV TLB exposed to the guests.  Additionally, the problem mainly affects AMD processors but we \
cannot rule out Intel CPUs.

From the patch cover note:

> The KVM hypervisor may provide a guest with ability to defer remote TLB
> flush when the remote VCPU is not running. When this feature is used,
> the TLB flush will happen only when the remote VPCU is scheduled to run
> again. This will avoid unnecessary (and expensive) IPIs.
> 
> Under certain circumstances, when a guest initiates such deferred action,
> the hypervisor may miss the request. It is also possible that the guest
> may mistakenly assume that it has already marked remote VCPU as needing a
> flush when in fact that request had already been processed by the hypervisor.
> In both cases this will result in an invalid translation being present in a
> vCPU, potentially allowing accesses to memory locations in that guest's
> address space that should not be accessible.
> 
> Note that only intra-guest memory is vulnerable.
> 
> The attached patches address both of these problems:
> 1. The first patch makes sure the hypervisor doesn't accidentally clear
> guest's remote flush request
> 2. The rest of the patches prevent the race between hypervisor
> acknowledging a remote flush request and guest issuing a new one.


Part of the attached patches were discovered independently[1] and made public on 2019-01-16 \
although it was our considered opinion that the security implications of this were not at all \
obvious so we kept the embargo.

The original patches posted to linux-distros broke ARM so I'm attaching the v2 patches.  These \
will be heading to the mainline kernel shortly.

jch


[1] https://lore.kernel.org/kvm/20200116001635.174948-1-jmattson@google.com


["CVE-2019-3016.v2.tgz" (CVE-2019-3016.v2.tgz)]

 ^<ks۶j
VDD=&'qZĉ'N{;,CRv&.HI4kL"Y$}a=VM]kW/: \
oc`<0}C7,C=ðzf}e8c \
8oZWT?\=	(._Թ/&pwe~i F00\2 \
u|4O^k9 9c莇ݑg849_0ct1VSA0Y1{
hai9kn8p~-y&{^1Cf֡gm
|9!wfW&3ZˀBMDhkKm+
> r9<~c:1(A ϋxx\SN(q|vbhxٵ͝Ke_A \
> .ۣS	<6	#LkNqXǗs8
tL4Ey?wp XQ{j8Cv愳&|b,zq:+QirU|˯|~
/Sw͵]jtgK?.=>)Șm]Q/@sAdN{f \
0y|o'>_byC״x0XU``?}T!k㗡3xB4d'=rlq܆5NZbK*0 \
Z\LݎBeGVŧN}jh  \
K-lpɥ(V>\;MCX-}p.8!<CxB̲i06`IMtKl,V*V3^DaŢ#?q3B'w<baB[BG$@?
 x`̓NԱqSA͑:fy׵[
zchmG7~)O|%Iau;ߧ޼:{*F**hD>la<nx"?hU[h-? \
Fd'ȉ=f߿zJx__ώ~:nnNU	k}'FdL=>yD,lh;.fi_#Zߝ:' \
FvP`q[Q};d* `[mF6wҕ̀WJi8Ev!`{v~D(Ql^{[ \
k>3@rZ v2_O{-^%q4^5Iv{{: \
2&Z)"ՙV,dO@:NP.P4tQcw= \
E߂g?w4Q%-Gd2GwROf=#iz@(فz	Smu5CQu@J`h/g헯ޟl{L̜ՏUz9.%k
 yz_7{tݮٵtKK_pWa:^<dfBR(JB$s(],1s"LxΌ \
"g	wfvykyry0H#B.4|̉ܩ6:EN?xq}6гǧg_3 \
>ʙ-9BID']ɔZhqi 5L51B+a\0wn8g3OiX>p
ĂRj9͂GW~F0fi6)tƮDS6bPx.g2`S7.9A
 ?	8c"fs{Or!5=Mc#FwWU-
3	zf`5<L
CMÞMʆoM3aּ@ȴFgcPr~2[S;"It?䃩fAC[HmbHH \
Nr8qdOǯPRb \
`_MK蘙Cr}AFEy'C=<解׸uȀv.l	;XYScNhSUɓ'Mt瓗q=U);l^E.
 (LCP~Ҩ-W6'/g'΅
v^ȱ&$"C	#:IP ɉÂIÇ H"sq-\h) \
k"_wzѪ#@@ l]` \
lV-D,qţ8@7i?f#ƀ'~Bkep)Hw=:؟ 4Vv |) \
]ed}=ADOb,IEK0̹acꬺ30AImA2U*	y-go[5r \
fЕ&/VD>>i`jiݎi|.8tf5f[&X#̆lţ;	|A,B7i&0_D޷+ \
uPv7d6`vgk,˽i-]ˆY֥gd_ϸ:,gKBut_C_;#vQdZ|ao&c}o+ahvghdRU
 G[UF)1thlv 1lf30"X֟/؎Mp> xy:2ay~ \
A?gNa \"/$-VY5wN(w22FWӆwsFÓ:չnMyko \
܋o+;{rҙGɨ e7oay/F!3, p2
p Oz=orGL;qFݞewX??3nXsgBrB向QKivŬ`#d5W<<b>y \
Nv@?#RؙQ#>qQ_>Nxd'WbA7R:V"{C)CPalM5t>״ȴ޸AEh \
RjRvGPT-Y^!nK0.)Zi1KdP5Z	',֨̕Z@QN>E@ \
8yi&vmm48aC@هpL왅Q,>.:}zt/IvZ7
 Jǹ/t僫9Hu$Be_#$Z=j|V=V+5=QD3DU<쮞d.<ɛuwqvRg*yTPom`u-xWmY_}Xq`xWZCVx1ZpY
 )y]1ݹ+Q2g0B0	Ԙyp()<ME7s	wiDQS;9Ѩ?{N)`9Џ\U0F"A!#D7Y$Ѿ%Rރ]΁h(AeɧL \
m01 V1V'|Ջg< IȆsňQ
ƈ6D+ޢ1+m`hcL,PFlU;INFtx \
f1G*aqǮ`<9$VEo+nzҀMtJ \
"hőJD]xQeȯ	#GhIr<NQ1GAy| ` Ft
> 12Bd<EI')W\;D8x1l|ihxInǽ \
> kA"0D(*r9uC']BdHcѱǿ춮m<A[yX~!X}ޞY`f \
> gU&I"POu7DWU`azՔnvOTr*^/\?_gNWFq_7ƣIG1]wE׸cvCktO*嫻?szZYU* \
> QiTد&i:	 
LR^E9Oo|ce'R \
Ol!\-[;@x+a0`˂p(%֪,л+l̯q1`:j|A`Qʑʁʑpоőؕ
 r!CH4Mp!H'yWbI&{ɚI]WJ3c\m_++>_k="^|E{ɿ/k?I/4}N \
|zApKx!emVո4Ń\1o V% g ˷RhID
`2Vas?dhIO+6]"|i!8;^ߢ$IJ=<`/Ep?D q
R Cԓ0q(4/D!ew/e-_:QU.K;Su]E|nr|ۮQ>e \
NwdUWkR&j^1#B5X!S25gcf&jÄ~{ƃ+YRyb,*A*ݧQ64j;LTY+bo9$n;He~MT}GVJ, \
2GaϝlTi&IYD&T(y: [Sa?] !<Qs?{ PH!jk[v
O3tZRxA@Q7TP)˖/TH&ˉS&Oamݿώm \
;eau|w1Ȍgܵ!.aHF?f?|VM+~\=tjJ嵐0W]-K֢Y3ԋ  
	lfm~no_!&JSDӡ.J[RZnn<Jdm1%>%d{Nu~E}ffUɌAq<};L \
|XiDxHH\%$(H?'!O^J(:\>GHVk\$q6"0~+(I4|&[\T3I5oH_%L&Zyݔ@b'o^<>ysz|
 P'$2aP)#cNco"1HqeVPyDL	T)oj醼DqRgC&ԍ[?i'gИ \
0Ⱦ~&59\?7+B9`ٝ[gm]ߵvl26'tyd:^}y}QH<w5B"/DRE@Kp62#:n,a3 \
/-췣7O6]6t \
&,1%-vt-DOMdާf@hg\A줔YLlQڃw^ \
(VsRs{qTuRm+pH$Eyo6`ܗr_}/ܗ0Ax


["signature.asc" (signature.asc)]

-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - http://gpgtools.org

iHUEAREIAB0WIQT+pxvb11CFWUkNSOVFC7t+lC+jyAUCXjMZowAKCRBFC7t+lC+j
yAYnAP9xWzZsYEh4zKYLd7yEyUbBQug9NxWhOJXq7uz1Ag8XZAD/fIpQie2WZN5B
fiCNpHvoLH9OuvBWFtQIRKm7p40JFic=
=nfv9
-----END PGP SIGNATURE-----


[prev in list] [next in list] [prev in thread] [next in thread] 

Configure | About | News | Add a list | Sponsored by KoreLogic