Issue metadata
Sign in to add a comment
|
CVE-2017-12154 CrOS: Vulnerability reported in Linux kernel |
||||||||||||||||||||||
Issue descriptionVOMIT (go/vomit) has received an external vulnerability report for the Linux kernel. Advisory: CVE-2017-12154 Details: http://vomit.googleplex.com/advisory?id=CVE/CVE-2017-12154 CVSS severity score: 3.6/10.0 Description: The prepare_vmcs02 function in arch/x86/kvm/vmx.c in the Linux kernel through 4.13.3 does not ensure that the "CR8-load exiting" and "CR8-store exiting" L0 vmcs02 controls exist in cases where L1 omits the "use TPR shadow" vmcs12 control, which allows KVM L2 guest OS users to obtain read and write access to the hardware CR8 register. This bug was filed by http://go/vomit Please contact us at vomit-team@google.com if you need any assistance.
,
Sep 29 2017
Upstream 51aa68e7d57e321 ("kvm: nVMX: Don't allow L2 to access the hardware CR8"). Only relevant if KVM is enabled which is true for Lakitu. It also can be enabled with a USE flag. All kernel versions up to and including chromeos-4.12 are affected.
,
Sep 29 2017
,
Sep 29 2017
Cherry-pick to chromeos-3.14 and earlier causes substantial conflicts; access control is much less specific in those releases. Will only fix in chromeos-3.18 and later.
,
Sep 29 2017
Thanks for looking at Lakitu Guenter. If it affects Lakitu we'll want the fix in all branches including 60 (still supported by Lakitu). We are only using the 4.4 kernel though. Let me know if you need any help on doing the cherrypicks.
,
Sep 29 2017
Hmm, I took a look too. Lakitu has CONFIG_KVM_GUEST enabled but not CONFIG_KVM, which is what this bug is about. So at least this doesn't impact Lakitu stable or beta. I don't think we'll ever intend Lakitu to run as a KVM host, but having the fix in master doesn't hurt.
,
Sep 29 2017
#6: Excellent. I'll modify priorities accordingly and drop stable requests.
,
Sep 29 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/third_party/kernel/+/77242038299782d63c49d1173bf268fa87fd1049 commit 77242038299782d63c49d1173bf268fa87fd1049 Author: Jim Mattson <jmattson@google.com> Date: Fri Sep 29 21:35:35 2017 UPSTREAM: kvm: nVMX: Don't allow L2 to access the hardware CR8 If L1 does not specify the "use TPR shadow" VM-execution control in vmcs12, then L0 must specify the "CR8-load exiting" and "CR8-store exiting" VM-execution controls in vmcs02. Failure to do so will give the L2 VM unrestricted read/write access to the hardware CR8. This fixes CVE-2017-12154. BUG= chromium:770155 TEST=Build and run Change-Id: Iff30767e0f89277022db25e52d39a6e151e59920 Signed-off-by: Jim Mattson <jmattson@google.com> Reviewed-by: David Hildenbrand <david@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Guenter Roeck <groeck@chromium.org> (cherry picked from commit 51aa68e7d57e321) Reviewed-on: https://chromium-review.googlesource.com/692738 Reviewed-by: Dylan Reid <dgreid@chromium.org> [modify] https://crrev.com/77242038299782d63c49d1173bf268fa87fd1049/arch/x86/kvm/vmx.c
,
Sep 30 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/third_party/kernel/+/35d2950bd457e45050b3c74f7c0b4759f4d8b8ac commit 35d2950bd457e45050b3c74f7c0b4759f4d8b8ac Author: Jim Mattson <jmattson@google.com> Date: Sat Sep 30 00:42:52 2017 UPSTREAM: kvm: nVMX: Don't allow L2 to access the hardware CR8 If L1 does not specify the "use TPR shadow" VM-execution control in vmcs12, then L0 must specify the "CR8-load exiting" and "CR8-store exiting" VM-execution controls in vmcs02. Failure to do so will give the L2 VM unrestricted read/write access to the hardware CR8. This fixes CVE-2017-12154. BUG= chromium:770155 TEST=Build and run Change-Id: Iff30767e0f89277022db25e52d39a6e151e59920 Signed-off-by: Jim Mattson <jmattson@google.com> Reviewed-by: David Hildenbrand <david@redhat.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Guenter Roeck <groeck@chromium.org> (cherry picked from commit 51aa68e7d57e321) Reviewed-on: https://chromium-review.googlesource.com/692838 [modify] https://crrev.com/35d2950bd457e45050b3c74f7c0b4759f4d8b8ac/arch/x86/kvm/vmx.c
,
Oct 2 2017
,
Oct 3 2017
,
Jan 8 2018
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by infe...@chromium.org
, Sep 29 2017Status: ExternalDependency (was: Untriaged)