Bugzilla – Bug 1199509
VUL-0: CVE-2022-0171: kernel-source,kernel-source-rt,kernel-source-azure: kernel: KVM: cache incoherence issue in SEV API may lead to kernel crash
Last modified: 2023-01-18 17:40:30 UTC
rh#2038940 The existing KVM SEV API has a vulnerability that allows a non-root (host) user-level application to crash the host kernel by creating a confidential guest VM instance in AMD CPU that supports SEV. Upstream fix: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=bb4ce2c65881a2b9bdcd384f54a260a12a89dd91 References: https://bugzilla.redhat.com/show_bug.cgi?id=2038940 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-0171
cve/linux-4.4 and older do not have SEV support, so they are not affected. For cve/linux-4.12 and cve/linux-5.3 the SEV code looks quite different, and I can't really find the equivalent cache flushes. In fact, only the code in SLE15-SP3 checks for hardware-enforced cache coherency. Thus, I'm tracking them as affected, but please let me know if this is not correct. SLE15-SP4-GA is also affected.
The relevant upstream commits seem to be the following: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4bbef7e8eb8c2c7dabf57d97decfd2b4f48aaf02 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d45829b351ee6ec5f54dd55e6aca1f44fe239fe6 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=683412ccf61294d727ead4a73d97397396e69a6b
Joerg, I think this is for you. See details of security bug handling at https://wiki.suse.net/index.php/SUSE-Labs/Kernel/Security
Hi Carlos, (In reply to Carlos López from comment #2) > The relevant upstream commits seem to be the following: > https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/ > ?id=4bbef7e8eb8c2c7dabf57d97decfd2b4f48aaf02 > https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/ > ?id=d45829b351ee6ec5f54dd55e6aca1f44fe239fe6 Just for my personal interest, where did you get the above two commits from? I can't find them referenced in any of the related documents. > https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/ > ?id=683412ccf61294d727ead4a73d97397396e69a6b
SLE15-SP4 backport is in users/jroedel/SLE15-SP4-GA/bsc1199509
(In reply to Joerg Roedel from comment #7) > SLE15-SP4 backport is in users/jroedel/SLE15-SP4-GA/bsc1199509 I think that this bug doesn't qualify for GA-merge, as CVSS is too low.
Backport for 5.3 is here: users/jroedel/cve/linux-5.3/bsc1199509 It only required https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=683412ccf61294d727ead4a73d97397396e69a6b The other two commits are only needed with SEV-ES host support, which is not in 5.3. Claudio, some changes to the patch were needed for the above backport. Could someone from your team have a look and do an additional review, please?
(In reply to Takashi Iwai from comment #8) > (In reply to Joerg Roedel from comment #7) > > SLE15-SP4 backport is in users/jroedel/SLE15-SP4-GA/bsc1199509 > > I think that this bug doesn't qualify for GA-merge, as CVSS is too low. Understood, thanks. Will move it over to the SLE15-SP4 branch.
SLE15-SP4 b(In reply to Takashi Iwai from comment #8) > (In reply to Joerg Roedel from comment #7) > > SLE15-SP4 backport is in users/jroedel/SLE15-SP4-GA/bsc1199509 > > I think that this bug doesn't qualify for GA-merge, as CVSS is too low. SLE15-SP4 backport now in users/jroedel/SLE15-SP4/bsc1199509
(In reply to Joerg Roedel from comment #9) > Backport for 5.3 is here: > > users/jroedel/cve/linux-5.3/bsc1199509 > > It only required > https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/ > ?id=683412ccf61294d727ead4a73d97397396e69a6b > > Claudio, some changes to the patch were needed for the above backport. Could > someone from your team have a look and do an additional review, please? > Hi! I've just had a look. The patch looks ok to me, and I also think it is a proper backport of the referenced upstream commit.
(In reply to Dario Faggioli from comment #12) > Hi! I've just had a look. The patch looks ok to me, and I also think it is a > proper backport of the referenced upstream commit. Thanks for your review, Dario! I pushed the change for inclusion into cve/linux-5.3.
These branches contain the fix(es): * master via upstream * stable via upstream * SLE15-SP4 via backport * cve/linux-5.3 via backport All older branches are not affected by this issue. Assigning back.
Done.