CVE-2020-8834
published 2020-04-09CVE-2020-8834: KVM in the Linux kernel on Power8 processors has a conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry plus in kvmppc_{save,restore}_tm…
PriorityP424medium6.5CVSS 3.1
AVLACLPRLUINSCCNINAH
EPSS
0.35%
27.0th percentile
KVM in the Linux kernel on Power8 processors has a conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry plus in kvmppc_{save,restore}_tm, leading to a stack corruption. Because of this, an attacker with the ability run code in kernel space of a guest VM can cause the host kernel to panic. There were two commits that, according to the reporter, introduced the vulnerability: f024ee098476 ("KVM: PPC: Book3S HV: Pull out TM state save/restore into separate procedures") 87a11bb6a7f7 ("KVM: PPC: Book3S HV: Work around XER[SO] bug in fake suspend mode") The former landed in 4.8, the latter in 4.17. This was fixed without realizing the impact in 4.18 with the following three commits, though it's believed the first is the only strictly necessary commit: 6f597c6b63b6 ("KVM: PPC: Book3S PR: Add guest MSR parameter for kvmppc_save_tm()/kvmppc_restore_tm()") 7b0e827c6970 ("KVM: PPC: Book3S HV: Factor fake-suspend handling out of kvmppc_save/restore_tm") 009c872a8bc4 ("KVM: PPC: Book3S PR: Move kvmppc_save_tm/kvmppc_restore_tm to separate file")
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | linux | < linux 4.18.6-1 (bookworm) | linux 4.18.6-1 (bookworm) |
| gnome | libcroco | >= 0 < 0.6.13-1ubuntu0.1 | 0.6.13-1ubuntu0.1 |
| gnome | libcroco | >= 0 < 0.6.8-2ubuntu1+esm1 | 0.6.8-2ubuntu1+esm1 |
| gnome | libcroco | >= 0 < 0.6.11-1ubuntu0.1~esm1 | 0.6.11-1ubuntu0.1~esm1 |
| gnome | libcroco | >= 0 < 0.6.12-2ubuntu0.1~esm1 | 0.6.12-2ubuntu0.1~esm1 |
| linux | linux_kernel | >= 0 < 4.18.6-1 | 4.18.6-1 |
| linux | linux_kernel | >= 0 < 4.18.6-1 | 4.18.6-1 |
| linux | linux_kernel | >= 0 < 4.18.6-1 | 4.18.6-1 |
| linux | linux_kernel | >= 0 < 4.18.6-1 | 4.18.6-1 |
| linux | linux_kernel | >= 0 < 4.15.0-96.97 | 4.15.0-96.97 |
| linux_kernel | linux_kernel | >= 4.8 < unspecified | unspecified |
| linux_kernel | linux_kernel | >= unspecified < 4.18 | 4.18 |
| opensuse | leap | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
nvdv2.04.9MEDIUMAV:L/AC:L/Au:N/C:N/I:N/A:C
osv7.1HIGH
vendor_ubuntu7.1HIGH
vendor_debian6.5MEDIUM
vendor_redhat6.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2020-04-06·CVSS 7.1
CVE-2020-8428 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Al Viro discovered that the vfs layer in the Linux kernel contained a use-
after-free vulnerability. A local attacker could use this to cause a denial
of service (system crash) or possibly expose sensitive information (kernel
memory). (CVE-2020-8428)
Gustavo Romero and Paul Mackerras discovered that the KVM implementation in
the Linux kernel for PowerPC processors did not properly keep guest state
separate from host state. A local attacker in a KVM guest could use this to
cause a denial of service (host system crash). (CVE-2020-8834)
Shijie Luo discovered that the ext4 file system implementation in the Linux
kernel did not properly check for a too-large journal size. An attacker
could u
Red Hat
Kernel: ppc: kvm: conflicting use of HSTATE_HOST_R1 to store r1 state leads to host stack corruption
vendor_redhat·2020-04-06·CVSS 6.5
CVE-2020-8834 [MEDIUM] CWE-121 Kernel: ppc: kvm: conflicting use of HSTATE_HOST_R1 to store r1 state leads to host stack corruption
Kernel: ppc: kvm: conflicting use of HSTATE_HOST_R1 to store r1 state leads to host stack corruption
KVM in the Linux kernel on Power8 processors has a conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry plus in kvmppc_{save,restore}_tm, leading to a stack corruption. Because of this, an attacker with the ability run code in kernel space of a guest VM can cause the host kernel to panic. There were two commits that, according to the reporter, introduced the vulnerability: f024ee098476 ("KVM: PPC: Book3S HV: Pull out TM state save/restore into separate procedures") 87a11bb6a7f7 ("KVM: PPC: Book3S HV: Work around XER[SO] bug in fake suspend mode") The former landed in 4.8, the latter in 4.17. This was fixed without realizing the impact in 4.18 with the following three comm
Debian
CVE-2020-8834: linux - KVM in the Linux kernel on Power8 processors has a conflicting use of HSTATE_HOS...
vendor_debian·2020·CVSS 6.5
CVE-2020-8834 [MEDIUM] CVE-2020-8834: linux - KVM in the Linux kernel on Power8 processors has a conflicting use of HSTATE_HOS...
KVM in the Linux kernel on Power8 processors has a conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry plus in kvmppc_{save,restore}_tm, leading to a stack corruption. Because of this, an attacker with the ability run code in kernel space of a guest VM can cause the host kernel to panic. There were two commits that, according to the reporter, introduced the vulnerability: f024ee098476 ("KVM: PPC: Book3S HV: Pull out TM state save/restore into separate procedures") 87a11bb6a7f7 ("KVM: PPC: Book3S HV: Work around XER[SO] bug in fake suspend mode") The former landed in 4.8, the latter in 4.17. This was fixed without realizing the impact in 4.18 with the following three commits, though it's believed the first is the only strictly necessary commit: 6f597c6b63b6 ("KVM: PPC: Bo
OSV
libcroco vulnerabilities
osv·2024-08-13·CVSS 5.5
CVE-2017-7960 libcroco vulnerabilities
libcroco vulnerabilities
It was discovered that Libcroco was incorrectly accessing data structures
when reading bytes from memory, which could cause a heap buffer overflow.
An attacker could possibly use this issue to cause a denial of service.
This issue only affected Ubuntu 14.04 LTS. (CVE-2017-7960)
It was discovered that Libcroco was incorrectly handling invalid UTF-8
values when processing CSS files. An attacker could possibly use this
issue to cause a denial of service. (CVE-2017-8834, CVE-2017-8871)
It was discovered that Libcroco was incorrectly implementing recursion in
one of its parsing functions, which could cause an infinite recursion
loop and a stack overflow due to stack consumption. An attacker could
possibly use this issue to cause a denial of service. (CVE-2020-12825)
GHSA
GHSA-7fx7-755p-qmjj: KVM in the Linux kernel on Power8 processors has a conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry plus in kvmppc_{save,restore
ghsa_unreviewed·2022-05-24
CVE-2020-8834 [MEDIUM] CWE-362 GHSA-7fx7-755p-qmjj: KVM in the Linux kernel on Power8 processors has a conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry plus in kvmppc_{save,restore
KVM in the Linux kernel on Power8 processors has a conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry plus in kvmppc_{save,restore}_tm, leading to a stack corruption. Because of this, an attacker with the ability run code in kernel space of a guest VM can cause the host kernel to panic. There were two commits that, according to the reporter, introduced the vulnerability: f024ee098476 ("KVM: PPC: Book3S HV: Pull out TM state save/restore into separate procedures") 87a11bb6a7f7 ("KVM: PPC: Book3S HV: Work around XER[SO] bug in fake suspend mode") The former landed in 4.8, the latter in 4.17. This was fixed without realizing the impact in 4.18 with the following three commits, though it's believed the first is the only strictly necessary commit: 6f597c6b63b6 ("KVM: PPC: Bo
OSV
libcroco vulnerabilities
osv·2022-04-26·CVSS 5.5
CVE-2017-7960 libcroco vulnerabilities
libcroco vulnerabilities
It was discovered that Libcroco was incorrectly accessing data structures when
reading bytes from memory, which could cause a heap buffer overflow. An attacker
could possibly use this issue to cause a denial of service. (CVE-2017-7960)
It was discovered that Libcroco was incorrectly handling invalid UTF-8 values
when processing CSS files. An attacker could possibly use this issue to cause
a denial of service. (CVE-2017-8834, CVE-2017-8871)
It was discovered that Libcroco was incorrectly implementing recursion in one
of its parsing functions, which could cause an infinite recursion loop and a
stack overflow due to stack consumption. An attacker could possibly use this
issue to cause a denial of service. (CVE-2020-12825)
OSV
CVE-2020-8834: KVM in the Linux kernel on Power8 processors has a conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry plus in kvmppc_{save,restore
osv·2020-04-09·CVSS 6.5
CVE-2020-8834 [MEDIUM] CVE-2020-8834: KVM in the Linux kernel on Power8 processors has a conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry plus in kvmppc_{save,restore
KVM in the Linux kernel on Power8 processors has a conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry plus in kvmppc_{save,restore}_tm, leading to a stack corruption. Because of this, an attacker with the ability run code in kernel space of a guest VM can cause the host kernel to panic. There were two commits that, according to the reporter, introduced the vulnerability: f024ee098476 ("KVM: PPC: Book3S HV: Pull out TM state save/restore into separate procedures") 87a11bb6a7f7 ("KVM: PPC: Book3S HV: Work around XER[SO] bug in fake suspend mode") The former landed in 4.8, the latter in 4.17. This was fixed without realizing the impact in 4.18 with the following three commits, though it's believed the first is the only strictly necessary commit: 6f597c6b63b6 ("KVM: PPC: Bo
OSV
linux, linux-hwe vulnerabilities
osv·2020-04-06·CVSS 7.1
CVE-2020-8428 [HIGH] linux, linux-hwe vulnerabilities
linux, linux-hwe vulnerabilities
Al Viro discovered that the vfs layer in the Linux kernel contained a use-
after-free vulnerability. A local attacker could use this to cause a denial
of service (system crash) or possibly expose sensitive information (kernel
memory). (CVE-2020-8428)
Gustavo Romero and Paul Mackerras discovered that the KVM implementation in
the Linux kernel for PowerPC processors did not properly keep guest state
separate from host state. A local attacker in a KVM guest could use this to
cause a denial of service (host system crash). (CVE-2020-8834)
Shijie Luo discovered that the ext4 file system implementation in the Linux
kernel did not properly check for a too-large journal size. An attacker
could use this to construct a malicious ext4 image that, when mounted,
could
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2020-8834 kernel: conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry in KVM leads to stack corruption [fedora-all]
bugzilla·2020-04-07·CVSS 6.5
CVE-2020-8834 [MEDIUM] CVE-2020-8834 kernel: conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry in KVM leads to stack corruption [fedora-all]
CVE-2020-8834 kernel: conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry in KVM leads to stack corruption [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit m
Bugzilla
CVE-2020-8834 Kernel: ppc: kvm: conflicting use of HSTATE_HOST_R1 to store r1 state leads to host stack corruption
bugzilla·2020-04-01·CVSS 6.5
CVE-2020-8834 [MEDIUM] CVE-2020-8834 Kernel: ppc: kvm: conflicting use of HSTATE_HOST_R1 to store r1 state leads to host stack corruption
CVE-2020-8834 Kernel: ppc: kvm: conflicting use of HSTATE_HOST_R1 to store r1 state leads to host stack corruption
A flaw was found in the way the KVM hypervisor on the Power8 processor stores the r1 register state in the 'HSTATE_HOST_R1' field on the Linux kernel stack. This flaw occurs while handling hypercalls in Transactional Memory (TM) suspend mode in the kvmppc_save_tm and kvmppc_restore_tm routines, leading to host stack corruption. R1 register holds a stack frame address and its corruption leads the kernel into panic state. A guest user can use this flaw to crash the host kernel, resulting in a denial of service.
Upstream patch:
-> https://git.kernel.org/linus/6f597c6b63b6f3675914b5ec8fcd008a58678650
-> https://git.kernel.org/linus/009c872a8bc4d38f487a9bd62423d019e4322517
-> htt
http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00035.htmlhttps://bugs.launchpad.net/ubuntu/+source/linux/+bug/1867717https://usn.ubuntu.com/4318-1/https://usn.ubuntu.com/usn/usn-4318-1https://www.openwall.com/lists/oss-security/2020/04/06/2http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00035.htmlhttps://bugs.launchpad.net/ubuntu/+source/linux/+bug/1867717https://usn.ubuntu.com/4318-1/https://usn.ubuntu.com/usn/usn-4318-1https://www.openwall.com/lists/oss-security/2020/04/06/2
2020-04-09
Published