Bug 1161154 (CVE-2019-3016)

Summary:	VUL-0: CVE-2019-3016: kernel-source: information leak within a KVM guest
Product:	[Novell Products] SUSE Security Incidents	Reporter:	Alexandros Toptsoglou <atoptsoglou>
Component:	Incidents	Assignee:	Security Team bot <security-team>
Status:	RESOLVED FIXED	QA Contact:	Security Team bot <security-team>
Severity:	Normal
Priority:	P3 - Medium	CC:	atoptsoglou, jroedel, meissner, mhocko, tiwai, wolfgang.frisch
Version:	unspecified
Target Milestone:	---
Hardware:	Other
OS:	Other
URL:	https://smash.suse.de/issue/251295/
Whiteboard:
Found By:	---	Services Priority:
Business Priority:		Blocker:	---
Marketing QA Status:	---	IT Deployment:	---
Attachments:	CVE-2019-3016.v2.tgz

Comment 19 Marcus Meissner 2020-01-31 06:55:36 UTC

is public

From: John Haxby <john.haxby@oracle.com>
Subject: [oss-security] CVE-2019-3016: information leak within a KVM guest
Date: Thu, 30 Jan 2020 18:00:03 +0000

The problem is missing TLB flushes which potentially allows a process in a KVM guest to access memory locations within that guest that it should not have access to.

The problem is limited to host kernels 4.10 onwards with guest kernels running 4.16 onwards and PV TLB exposed to the guests.  Additionally, the problem mainly affects AMD processors but we cannot rule out Intel CPUs.

From the patch cover note:

> The KVM hypervisor may provide a guest with ability to defer remote TLB
> flush when the remote VCPU is not running. When this feature is used,
> the TLB flush will happen only when the remote VPCU is scheduled to run
> again. This will avoid unnecessary (and expensive) IPIs.
> 
> Under certain circumstances, when a guest initiates such deferred action,
> the hypervisor may miss the request. It is also possible that the guest
> may mistakenly assume that it has already marked remote VCPU as needing a
> flush when in fact that request had already been processed by the hypervisor.
> In both cases this will result in an invalid translation being present in a
> vCPU, potentially allowing accesses to memory locations in that guest's
> address space that should not be accessible.
> 
> Note that only intra-guest memory is vulnerable.
> 
> The attached patches address both of these problems:
> 1. The first patch makes sure the hypervisor doesn't accidentally clear
> guest's remote flush request
> 2. The rest of the patches prevent the race between hypervisor
> acknowledging a remote flush request and guest issuing a new one.

Part of the attached patches were discovered independently[1] and made public on 2019-01-16 although it was our considered opinion that the security implications of this were not at all obvious so we kept the embargo.

The original patches posted to linux-distros broke ARM so I'm attaching the v2 patches.  These will be heading to the mainline kernel shortly.

jch

[1] https://lore.kernel.org/kvm/20200116001635.174948-1-jmattson@google.com

Comment 20 Marcus Meissner 2020-01-31 06:56:45 UTC

Created attachment 828769 [details]
CVE-2019-3016.v2.tgz

CVE-2019-3016.v2.tgz

Comment 21 Joerg Roedel 2020-01-31 09:23:46 UTC

(In reply to Marcus Meissner from comment #20)
> Created attachment 828769 [details]
> CVE-2019-3016.v2.tgz
> 
> CVE-2019-3016.v2.tgz

Backported and pushed these patches for inclusion into SLE15-SP2 branch.

Older branches are not affected by this bug.

Comment 22 Joerg Roedel 2020-01-31 09:47:06 UTC

Patches now also backported and pushed to the stable and master branch.

Comment 23 Joerg Roedel 2020-02-04 13:10:04 UTC

Nothing left to do, assigning back.

Comment 24 Alexandros Toptsoglou 2020-04-29 12:52:31 UTC

Closing