VOMIT (go/vomit) has received an external vulnerability report for the Linux kernel.
Advisory: CVE-2018-10901
Details: http://vomit.googleplex.com/advisory?id=CVE/CVE-2018-10901
CVSS severity score: 7.2/10.0
Description:
A flaw was found in Linux kernel's KVM virtualization subsystem. The VMX code does not restore the GDT.LIMIT to the previous host value, but instead sets it to 64KB. With a corrupted GDT limit a host's userspace code has an ability to place malicious entries in the GDT, particularly to the per-cpu variables. An attacker can use this to escalate their privileges.
This bug was filed by http://go/vomit
Please contact us at vomit-team@google.com if you need any assistance.
Comment 1 by zsm@chromium.org
, Oct 3Labels: Security_Severity-High Security_Impact-None Pri-2
Owner: zsm@chromium.org
Status: Fixed (was: Untriaged)
Upstream commit is 3444d7da183 ("KVM: VMX: Fix host GDT.LIMIT corruption") This commit is present in v4.14, v4.4, v3.18, v3.14, v3.10, v3.8. Marking this as Fixed.