[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20220407090624.GA17007@openwall.com>
Date: Thu, 7 Apr 2022 11:06:24 +0200
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Cc: kangel <kangel@....edu.cn>, pgn@....edu.cn, qiuhao@...ec.org,
Pedro Sampaio <psampaio@...hat.com>,
Paolo Bonzini <pbonzini@...hat.com>
Subject: Re: Linux kernel: x86/kvm: null-ptr-deref in kvm_dirty_ring_push
On Thu, Apr 07, 2022 at 10:53:17AM +0200, Paolo Bonzini wrote:
> indeed it doesn't cross guest-host boundaries. However, /dev/kvm is
> accessible by unprivileged users, so it should be treated like any other
> unprivileged NULL pointer dereference in Linux. I do not apply an
> embargo for those bugs, but whether to assign a CVE is not my choice.
Oh, indeed. So it's a local DoS for systems with user-accessible
/dev/kvm and panic_on_oops=1, like RHEL and its rebuilds. Makes sense
to have a CVE ID, then. (I assume that mmap_min_addr works.)
Alexander
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
