Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

fstec логотип

BDU:2020-02415

Опубликовано: 09 апр. 2020
Источник: fstec
CVSS3: 6.5
CVSS2: 4.6
EPSS Низкий

Описание

Уязвимость компонента HSTATE_HOST_R1 подсистемы виртуализации Kernel-based Virtual Machine (KVM) ядра операционных систем Linux вызвана ошибками синхронизации при использовании общего ресурса. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании

Вендор

Red Hat Inc.
Canonical Ltd.
Сообщество свободного программного обеспечения
Novell Inc.

Наименование ПО

Red Hat Enterprise Linux
Ubuntu
Debian GNU/Linux
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise Workstation Extension
Suse Linux Enterprise Server
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Module for Development Tools
SUSE Linux Enterprise High Availability
SUSE Linux Enterprise Live Patching
SUSE Linux Enterprise Module for Legacy Software
SUSE Linux Enterprise Module for Open Buildservice Development Tools
OpenSUSE Leap
SUSE Linux Enterprise Module for Live Patching
SUSE Linux Enterprise Module for Public Cloud
SUSE Linux Enterprise Module for Realtime packages
SUSE Linux Enterprise Real Time Extension
Linux

Версия ПО

7 (Red Hat Enterprise Linux)
16.04 LTS (Ubuntu)
9 (Debian GNU/Linux)
18.04 LTS (Ubuntu)
12 SP4 (SUSE Linux Enterprise Server for SAP Applications)
12 SP4 (SUSE Linux Enterprise Workstation Extension)
12 SP4 (Suse Linux Enterprise Server)
15 SP1 (SUSE Linux Enterprise Module for Basesystem)
15 SP1 (SUSE Linux Enterprise Module for Development Tools)
12 SP4 (SUSE Linux Enterprise High Availability)
15 SP1 (SUSE Linux Enterprise High Availability)
12 SP4 (SUSE Linux Enterprise Live Patching)
15 SP1 (SUSE Linux Enterprise Module for Legacy Software)
15 SP1 (SUSE Linux Enterprise Workstation Extension)
15 SP1 (SUSE Linux Enterprise Module for Open Buildservice Development Tools)
15.1 (OpenSUSE Leap)
15 SP1 (SUSE Linux Enterprise Module for Live Patching)
12 SP5 (Suse Linux Enterprise Server)
12 SP5 (SUSE Linux Enterprise Server for SAP Applications)
15 SP1 (SUSE Linux Enterprise Module for Public Cloud)
8 (Debian GNU/Linux)
10 (Debian GNU/Linux)
12 SP5 (SUSE Linux Enterprise High Availability)
15 SP1 (SUSE Linux Enterprise Module for Realtime packages)
12 SP4 (SUSE Linux Enterprise Real Time Extension)
12 SP5 (SUSE Linux Enterprise Workstation Extension)
12 SP5 (SUSE Linux Enterprise Live Patching)
12 SP5 (SUSE Linux Enterprise Real Time Extension)
от 4.1.31 до 4.1 включительно (Linux)
от 4.4.19 до 4.4 включительно (Linux)
от 4.7.2 до 4.17 включительно (Linux)

Тип ПО

Операционная система
Прикладное ПО информационных систем

Операционные системы и аппаратные платформы

Red Hat Inc. Red Hat Enterprise Linux 7
Canonical Ltd. Ubuntu 16.04 LTS
Сообщество свободного программного обеспечения Debian GNU/Linux 9
Canonical Ltd. Ubuntu 18.04 LTS
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 12 SP4
Novell Inc. Suse Linux Enterprise Server 12 SP4
Novell Inc. OpenSUSE Leap 15.1
Novell Inc. Suse Linux Enterprise Server 12 SP5
Novell Inc. SUSE Linux Enterprise Server for SAP Applications 12 SP5
Сообщество свободного программного обеспечения Debian GNU/Linux 8
Сообщество свободного программного обеспечения Debian GNU/Linux 10
Сообщество свободного программного обеспечения Linux от 4.1.31 до 4.1 включительно
Сообщество свободного программного обеспечения Linux от 4.4.19 до 4.4 включительно
Сообщество свободного программного обеспечения Linux от 4.7.2 до 4.17 включительно

Уровень опасности уязвимости

Средний уровень опасности (базовая оценка CVSS 2.0 составляет 4,6)
Средний уровень опасности (базовая оценка CVSS 3.0 составляет 6,5)

Возможные меры по устранению уязвимости

Использование рекомендаций:
Для Linux:
Обновление программного обеспечения до актуальной версиии
Для программных продуктов Novell Inc.:
https://www.suse.com/security/cve/CVE-2020-8834/
Для программных продуктов Red Hat Inc.:
https://access.redhat.com/security/cve/cve-2020-8834
Для Ubuntu:
https://usn.ubuntu.com/4318-1/
Для Debian GNU/Linux:
https://security-tracker.debian.org/tracker/CVE-2020-8834

Статус уязвимости

Подтверждена производителем

Наличие эксплойта

Существует в открытом доступе

Информация об устранении

Уязвимость устранена

Идентификаторы других систем описаний уязвимостей

EPSS

Процентиль: 26%
0.0009
Низкий

6.5 Medium

CVSS3

4.6 Medium

CVSS2

Связанные уязвимости

CVSS3: 6.5
ubuntu
почти 6 лет назад

KVM in the Linux kernel on Power8 processors has a conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry plus in kvmppc_{save,restore}_tm, leading to a stack corruption. Because of this, an attacker with the ability run code in kernel space of a guest VM can cause the host kernel to panic. There were two commits that, according to the reporter, introduced the vulnerability: f024ee098476 ("KVM: PPC: Book3S HV: Pull out TM state save/restore into separate procedures") 87a11bb6a7f7 ("KVM: PPC: Book3S HV: Work around XER[SO] bug in fake suspend mode") The former landed in 4.8, the latter in 4.17. This was fixed without realizing the impact in 4.18 with the following three commits, though it's believed the first is the only strictly necessary commit: 6f597c6b63b6 ("KVM: PPC: Book3S PR: Add guest MSR parameter for kvmppc_save_tm()/kvmppc_restore_tm()") 7b0e827c6970 ("KVM: PPC: Book3S HV: Factor fake-suspend handling out of kvmppc_save/restore_tm") 009c872a8bc4 ("KVM: PPC:...

CVSS3: 6
redhat
почти 6 лет назад

KVM in the Linux kernel on Power8 processors has a conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry plus in kvmppc_{save,restore}_tm, leading to a stack corruption. Because of this, an attacker with the ability run code in kernel space of a guest VM can cause the host kernel to panic. There were two commits that, according to the reporter, introduced the vulnerability: f024ee098476 ("KVM: PPC: Book3S HV: Pull out TM state save/restore into separate procedures") 87a11bb6a7f7 ("KVM: PPC: Book3S HV: Work around XER[SO] bug in fake suspend mode") The former landed in 4.8, the latter in 4.17. This was fixed without realizing the impact in 4.18 with the following three commits, though it's believed the first is the only strictly necessary commit: 6f597c6b63b6 ("KVM: PPC: Book3S PR: Add guest MSR parameter for kvmppc_save_tm()/kvmppc_restore_tm()") 7b0e827c6970 ("KVM: PPC: Book3S HV: Factor fake-suspend handling out of kvmppc_save/restore_tm") 009c872a8bc4 ("KVM: PPC:...

CVSS3: 6.5
nvd
почти 6 лет назад

KVM in the Linux kernel on Power8 processors has a conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry plus in kvmppc_{save,restore}_tm, leading to a stack corruption. Because of this, an attacker with the ability run code in kernel space of a guest VM can cause the host kernel to panic. There were two commits that, according to the reporter, introduced the vulnerability: f024ee098476 ("KVM: PPC: Book3S HV: Pull out TM state save/restore into separate procedures") 87a11bb6a7f7 ("KVM: PPC: Book3S HV: Work around XER[SO] bug in fake suspend mode") The former landed in 4.8, the latter in 4.17. This was fixed without realizing the impact in 4.18 with the following three commits, though it's believed the first is the only strictly necessary commit: 6f597c6b63b6 ("KVM: PPC: Book3S PR: Add guest MSR parameter for kvmppc_save_tm()/kvmppc_restore_tm()") 7b0e827c6970 ("KVM: PPC: Book3S HV: Factor fake-suspend handling out of kvmppc_save/restore_tm") 009c872a8bc4 ("KVM: PPC: Bo

CVSS3: 6.5
debian
почти 6 лет назад

KVM in the Linux kernel on Power8 processors has a conflicting use of ...

CVSS3: 6.5
github
больше 3 лет назад

KVM in the Linux kernel on Power8 processors has a conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry plus in kvmppc_{save,restore}_tm, leading to a stack corruption. Because of this, an attacker with the ability run code in kernel space of a guest VM can cause the host kernel to panic. There were two commits that, according to the reporter, introduced the vulnerability: f024ee098476 ("KVM: PPC: Book3S HV: Pull out TM state save/restore into separate procedures") 87a11bb6a7f7 ("KVM: PPC: Book3S HV: Work around XER[SO] bug in fake suspend mode") The former landed in 4.8, the latter in 4.17. This was fixed without realizing the impact in 4.18 with the following three commits, though it's believed the first is the only strictly necessary commit: 6f597c6b63b6 ("KVM: PPC: Book3S PR: Add guest MSR parameter for kvmppc_save_tm()/kvmppc_restore_tm()") 7b0e827c6970 ("KVM: PPC: Book3S HV: Factor fake-suspend handling out of kvmppc_save/restore_tm") 009c872a8bc4 ("KVM: PPC:...

EPSS

Процентиль: 26%
0.0009
Низкий

6.5 Medium

CVSS3

4.6 Medium

CVSS2