oss-security - KVM L1 guest escape

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20180627105607.kfnby2kf3arj3awc@suse.de>
Date: Wed, 27 Jun 2018 12:56:07 +0200
From: Marcus Meissner <meissner@...e.de>
To: OSS Security List <oss-security@...ts.openwall.com>
Subject: KVM L1 guest escape - CVE-2018-12904

Hi,

KVM in Linux Kernel between 4.12 and 4.18rc1 has a guest escape allowing
privilege escalation, found by Felix Wilhelm of Google Project Zero.

mitre entry:

[Suggested description]
In
arch/x86/kvm/vmx.c in
the Linux kernel before 4.17.2, when nested virtualization is used,
local attackers could cause L1 KVM guests to VMEXIT, potentially
allowing privilege escalations and denial of service attacks due to
lack of checking of CPL.

------------------------------------------

[Vulnerability Type]
Incorrect Access Control

------------------------------------------

[Vendor of Product]
Linux

------------------------------------------

[Affected Product Code Base]
Kernel - before 4.18.rc1

------------------------------------------

[Affected Component]
KVM implementation in the Linux Kernel

------------------------------------------

[Attack Type]
Local

------------------------------------------

[Impact Denial of Service]
true

------------------------------------------

[Impact Escalation of Privileges]
true

------------------------------------------

[Attack Vectors]
local attacker able to execute code

------------------------------------------

[Reference]
https://bugs.chromium.org/p/project-zero/issues/detail?id=1589
https://github.com/torvalds/linux/commit/727ba748e110b4de50d142edca9d6a9b7e6111d8
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=727ba748e110b4de50d142edca9d6a9b7e6111d8
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.17.2

------------------------------------------

[Has vendor confirmed or acknowledged the vulnerability?]
true

------------------------------------------

[Discoverer]
Felix Wilhelm of Google Project Zero

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.