Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.
Bug 1647573 (CVE-2018-19961, CVE-2018-19962) - CVE-2018-19961 CVE-2018-19962 xen: insufficient TLB flushing / improper large page mappings with AMD IOMMUs
Summary: CVE-2018-19961 CVE-2018-19962 xen: insufficient TLB flushing / improper large...
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2018-19961, CVE-2018-19962
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1651665
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-11-07 19:59 UTC by Laura Pardo
Modified: 2021-02-16 22:47 UTC (History)
22 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2018-11-08 16:23:08 UTC
Embargoed:


Attachments (Terms of Use)

Description Laura Pardo 2018-11-07 19:59:54 UTC
A flaw was found in xen. In order to be certain that no undue access to memory is possible anymore after IOMMU mappings of this memory have been removed, Translation Lookaside Buffers (TLBs) need to be flushed after most changes to such mappings. Xen bypassed certain IOMMU flushes on AMD
x86 hardware. Furthermore logic exists Xen to re-combine small page mappings into larger ones. Such re-combination could have occured in cases when it was not really safe/correct to do so.

Comment 1 Andrej Nemec 2018-11-20 14:11:40 UTC
References:

https://seclists.org/oss-sec/2018/q4/154

Comment 2 Andrej Nemec 2018-11-20 14:11:52 UTC
Acknowledgments:

Name: the Xen project

Comment 3 Andrej Nemec 2018-11-20 14:13:07 UTC
Created xen tracking bugs for this issue:

Affects: fedora-all [bug 1651665]


Note You need to log in before you can comment on or make changes to this bug.