CVE-2020-8834: Linux kernel KVM Power8 conflicting use of HSTATE_HOST_R1
A flaw was found in the way the KVM hypervisor on the Power8 processor stores the r1 register state in the 'HSTATEHOSTR1' field on the Linux kernel stack. This flaw occurs while handling hypercalls in Transactional Memory (TM) suspend mode in the kvmppcsavetm and kvmppcrestoretm routines, leading to host stack corruption. R1 register holds a stack frame address and its corruption leads the kernel into panic state. A guest user can use this flaw to crash the host kernel, resulting in a denial of service.
Other sources
KVM in the Linux kernel on Power8 processors has a conflicting use of HSTATEHOSTR1 to store r1 state in kvmppchventry plus in kvmppc{save,restore}tm, leading to a stack corruption. Because of this, an attacker with the ability run code in kernel space of a guest VM can cause the host kernel to panic. There were two commits that, according to the reporter, introduced the vulnerability: f024ee098476 ("KVM: PPC: Book3S HV: Pull out TM state save/restore into separate procedures") 87a11bb6a7f7 ("KVM: PPC: Book3S HV: Work around XER[SO] bug in fake suspend mode") The former landed in 4.8, the latter in 4.17. This was fixed without realizing the impact in 4.18 with the following three commits, though it's believed the first is the only strictly necessary commit: 6f597c6b63b6 ("KVM: PPC: Book3S PR: Add guest MSR parameter for kvmppcsavetm()/kvmppcrestoretm()") 7b0e827c6970 ("KVM: PPC: Book3S HV: Factor fake-suspend handling out of kvmppcsave/restoretm") 009c872a8bc4 ("KVM: PPC: Book3S PR: Move kvmppcsavetm/kvmppcrestoretm to separate file")
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-altto a version that resolves this vulnerability.Fixed in 0:4.14.0-115.26.1.el7a - Upgrade
Upgrade
redhat/Linuxto a version that resolves this vulnerability.Fixed in 4.18 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.8-1Fixed in 7.1.8-2 - Upgrade
Upgrade
Linux kernel KVM on Power8 (KVM: PPC Book3S HV/PR TM suspend handling with HSTATE_HOST_R1)to a version that resolves this vulnerability.Patch 6f597c6b63b6f3675914b5ec8fcd008a58678650 - Upgrade
Upgrade
Linux kernel KVM on Power8 (KVM: PPC Book3S HV/PR TM suspend handling with HSTATE_HOST_R1)to a version that resolves this vulnerability.Patch 7b0e827c6970e8ca77c60ae87592204c39e41245 - Upgrade
Upgrade
Linux kernel KVM on Power8 (KVM: PPC Book3S HV/PR TM suspend handling with HSTATE_HOST_R1)to a version that resolves this vulnerability.Patch 009c872a8bc4d38f487a9bd62423d019e4322517
Event History
Frequently Asked Questions
What is CVE-2020-8834?
CVE-2020-8834 is a vulnerability in the Linux kernel on Power8 processors that allows an attacker with code execution in a guest VM to cause stack corruption in the host kernel.
What is the severity of CVE-2020-8834?
CVE-2020-8834 has a severity rating of high.
Which software is affected by CVE-2020-8834?
CVE-2020-8834 affects Linux kernel versions 4.15.0-96.97 and 4.18~.
How can I fix CVE-2020-8834?
To fix CVE-2020-8834, update your Linux kernel to version 4.15.0-96.97 or 4.18~.
Where can I find more information about CVE-2020-8834?
You can find more information about CVE-2020-8834 on the Ubuntu Security Notice (USN) page and the Openwall mailing list.