New issue
Advanced search Search tips

Issue 878352 link

Starred by 1 user
Status: WontFix
Owner:
zsm@chromium.org
Closed: Aug 28
Cc:
rkolchmeyer@google.com
wonderfly@google.com
groeck@chromium.org
chromeos-kernel-security-bug-access@google.com
Components:
EstimatedDays: ----
NextAction: ----
OS: Chrome
Pri: 3
Type: Bug-Security



Sign in to add a comment

CVE-2018-12904 CrOS: Vulnerability reported in Linux kernel

Project Member Reported by vomit.go...@appspot.gserviceaccount.com, Aug 28 
VOMIT (go/vomit) has received an external vulnerability report for the Linux kernel. 

Advisory: CVE-2018-12904
  Details: http://vomit.googleplex.com/advisory?id=CVE/CVE-2018-12904
  CVSS severity score: 4.4/10.0
  Description:

In arch/x86/kvm/vmx.c in the Linux kernel before 4.17.2, when nested virtualization is used, local attackers could cause L1 KVM guests to VMEXIT, potentially allowing privilege escalations and denial of service attacks due to lack of checking of CPL.



This bug was filed by http://go/vomit
Please contact us at vomit-team@google.com if you need any assistance.

Comment 1 by dgreid@google.com, Aug 28 

The good news is that we don't use nested virtualization, and after L1TF we might never. However, if there is already a patch, it would be nice to have in kernels that run VMs.

Comment 2 by zsm@google.com, Aug 28

Cc: groeck@chromium.org wonderfly@chromium.org
Labels: Security_Severity-Low Security_Impact-None Pri-3
Owner: zsm@chromium.org
Status: WontFix (was: Untriaged)
Upstream commit is 727ba748e("kvm: nVMX: Enforce cpl=0 for VMX instructions").
This commit is present in v4.14. Older kernels do not have this commit.

The fixes tag for the commit is 70f3aac("kvm: nVMX: Remove superfluous VMX instruction fault checks"), which is not present in 4.4. Marking as WontFix.

Comment 3 by groeck@chromium.org, Aug 28

Cc: -wonderfly@chromium.org wonderfly@google.com
Fixed in chromeos-4.14 with merge of v4.14.50. The offending patch is commit 70f3aac964ae("kvm: nVMX: Remove superfluous VMX instruction fault checks"), which is not present in v4.4.y. chromeos-4.4 and earlier kernels are thus presumably not affected by this problem.

Note that this does not mean that chromeos-4.4 is safe for use in this scenario; the L1TF backport to v4.4.y does not include kvm changes.

Comment 4 by wonderfly@google.com, Aug 28

Cc: rkolchmeyer@google.com
►

Sign in to add a comment