New issue
Advanced search Search tips

Issue 857089 link

Starred by 1 user
Status: Duplicate
Merged: issue 853529
Owner:
groeck@chromium.org
Closed: Jun 2018
Cc:
rkolchmeyer@google.com
wonderfly@google.com
zsm@chromium.org
groeck@chromium.org
dgreid@chromium.org
chromeos-kernel-security-bug-access@google.com
Components:
EstimatedDays: ----
NextAction: ----
OS: Chrome
Pri: 1
Type: Bug-Security



Sign in to add a comment

Security: KVM (nested virtualization): privilege escalation in L1 guest|

Project Member Reported by jorgelo@chromium.org, Jun 27 2018 
See https://bugs.chromium.org/p/project-zero/issues/detail?id=1589 for details.

Affects KVM in the Linux kernel between 4.12 and 4.18rc1.

Fix at https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/arch/x86/kvm?id=727ba748e110b4de50d142edca9d6a9b7e6111d8

I guess we'll likely get this fix as part of the 4.14 stable update.

Sec_Impact is none because we don't enable nested virt for now, but we should try to pick up the fix just in case, but Sec_Severity is high because something this close to a VM escape is Kind of a Big Deal.

Comment 1 by groeck@chromium.org, Jun 27 2018

Cc: wonderfly@google.com
Labels: CVE-2018-12904
Owner: groeck@chromium.org
Status: Assigned (was: Available)
The fix has already been merged into chromeos-4.14 with the merge of v4.14.50 ( crbug.com/853529 ). Leaving as Assigned, waiting for feedback from Lakitu if the fix is required in beta/stable.

Comment 2 by jorgelo@chromium.org, Jun 27 2018 

Thanks for the update.

Comment 3 by wonderfly@google.com, Jun 27 2018

Cc: rkolchmeyer@google.com
Lakitu doesn't support nested KVM yet so having the fix at head is fine.

Comment 4 by groeck@chromium.org, Jun 27 2018

Mergedinto: 853529
Status: Duplicate (was: Assigned)
#3: Excellent. Marking as Duplicate of merge commit.
Project Member

Comment 5 by sheriffbot@chromium.org, Oct 4

Labels: -Restrict-View-SecurityTeam allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
►

Sign in to add a comment