[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <4fd4c465-35a5-4ca5-f549-6392ecb10330@sysec.org>
Date: Thu, 7 Apr 2022 17:16:26 +0800
From: Qiuhao Li <qiuhao@...ec.org>
To: Solar Designer <solar@...nwall.com>, kangel <kangel@....edu.cn>
Cc: oss-security@...ts.openwall.com, pgn@....edu.cn,
Pedro Sampaio <psampaio@...hat.com>, pbonzini@...hat.com
Subject: Re: Linux kernel: x86/kvm: null-ptr-deref in
kvm_dirty_ring_push
On 4/7/22 16:35, Solar Designer wrote:
> Further in the linux-distros thread, this got assigned CVE-2022-1263,
> however is this really a security issue - in other words, is a security
> boundary crossed in triggering the bug? I think it is not, and if so
> the CVE ID should probably be rejected. From the PoC:
>
>> res = syscall(__NR_openat, 0xffffffffffffff9cul, "/dev/kvm", 0ul, 0ul);
We sent the report to oss-security as instructed by linux-distro.
As Paolo said, /dev/kvm can be accessed by an unprivileged local user.
So it's a Dos. It also seems like there is a kernel NPD issue on oss
before: https://www.openwall.com/lists/oss-security/2022/04/02/5
>
> In fact, also in the linux-distros thread it was promptly agreed that
> this doesn't need an embargo - perhaps precisely because of no security
> relevance? If so, that should have been said explicitly, so a CVE ID
> wouldn't be assigned (it was by another person).
We are willing to cooperate with the final decision of the CVE issuer
and oss-security.
Personally, I agree with Paolo this is not a scary bug. No embargo makes
it be fixed quickly.
Regards,
Qiuhao Li
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
