oss-sec mailing list archives
Re: CVE-2019-14835: QEMU-KVM Guest to Host Kernel Escape Vulnerability: vhost/vhost_net kernel buffer overflow
From: Tina Li <tli () digitalocean com>
Date: Wed, 9 Oct 2019 13:04:30 -0500
Hi Bo, Thanks for your reply.
This vulnerability is a kernel vul and different verison of Qemu should not affect the reproduce. Try the following steps: 1. The guest kernel patch is for this version: Ubuntu-hwe-4.15.0-50.54_16.04.1( https://kernel.ubuntu.com/git/ubuntu/ubuntu-xenial.git/tree/drivers/virtio/virtio_ring.c?h=Ubuntu-hwe-4.15.0-50.54_16.04.1), if you use different kernel version, the patch may need to be modified slightly. The patch makes the guest kernel create a invalid descriptor table and the echo command is just to trigger the bug through a kernel variable.
Our host kernel is 4.15 and it is unpatched. In the guest, we use the reproducer patch that you provided for Ubuntu-hwe-4.15.0-50.54_16.04.1. But it doesn't work for us, and it is either crashing the guest or not able to crash the host during the migration. 1. If we ssh to the guest, and run the echo command to trigger the bug. Then the guest kernel crashes, even before the modprobe command is executed. 2. If we use the console to access the guest, then we can run echo/modprobe -r /modprobe commands successfully. But later the live migration is always successful, and the host is not crashed. So, as described above, we are not able to reproduce the host crash with the provided patch because either the guest crashes with the patch or live migration succeeds when the guest is not crashing. Would it be possible for you to have another look at the patches that you used to reproduce and probably post if the patches that you have differs from the posted one? Thanks a lot! Best regards, Tina
2. Ubuntu had released the patched kernel, the host kernel you used should not be patched(< 5.2.x) for reproducing the vulnerability. Thanks! cradmin of Tencent Blade Team
Current thread:
- Re: CVE-2019-14835: QEMU-KVM Guest to Host Kernel Escape Vulnerability: vhost/vhost_net kernel buffer overflow Tina Li (Oct 03)
- Re: CVE-2019-14835: QEMU-KVM Guest to Host Kernel Escape Vulnerability: vhost/vhost_net kernel buffer overflow bo Zhang (Oct 09)
- Re: CVE-2019-14835: QEMU-KVM Guest to Host Kernel Escape Vulnerability: vhost/vhost_net kernel buffer overflow Tina Li (Oct 09)
- Re: CVE-2019-14835: QEMU-KVM Guest to Host Kernel Escape Vulnerability: vhost/vhost_net kernel buffer overflow bo Zhang (Oct 09)