Description
In the Linux kernel, the following vulnerability has been resolved: KVM: s390: Zero initialize data structures for inject_pfault_token __kvm_inject_pfault_token() only sets .type and .u.ext.ext_params2 of the on-stack struct kvm_s390_irq but the full ext substructure is copied into the cpu local variable on inject. ext_params and pad contain stale stack values. Interrupt delivery only uses ext_params2, so nothing leaks to the guest, but a host user can use the migration ioctls to get to the data. Fix by zero-initializing the irq struct. Do the same for the inti data structure.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
383d0b050106abecb82f43101cac94fa423af5cd to < 3da26db3323cbccf509005fdbc4ebae842d323cdaffected383d0b050106abecb82f43101cac94fa423af5cd to < 5b0ae4443383fbacd905522f0c95ad6c85a3b43eaffected383d0b050106abecb82f43101cac94fa423af5cd to < 7090818ba774d254eba80979c2d4da23d91de02faffected383d0b050106abecb82f43101cac94fa423af5cd to < ab1a8a3c9971200938093370da4c67d4427c25f2affected383d0b050106abecb82f43101cac94fa423af5cd to < b8abc760fa18a389319d977834a30550b3ec18e8affected383d0b050106abecb82f43101cac94fa423af5cd to < 9b046de62b8098af6e2ba820b125ec9dc5f162c8affected383d0b050106abecb82f43101cac94fa423af5cd to < 134f235e0e8de54611a72d3cc3f63e5f31246baaaffected383d0b050106abecb82f43101cac94fa423af5cd to < 4e2c7f7cbc27418f9a290399b986c1b85ff93b90affected
Linux Linux
Default version status: affected
3.19affected0 to < 3.19unaffected5.10.273 to ≤ 5.10.*unaffected5.15.224 to ≤ 5.15.*unaffected6.1.191 to ≤ 6.1.*unaffected6.6.160 to ≤ 6.6.*unaffected6.12.112 to ≤ 6.12.*unaffected6.18.52 to ≤ 6.18.*unaffected7.2.5 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/3da26db3323cbccf509005fdbc4ebae842d323cd ↗
- https://git.kernel.org/stable/c/5b0ae4443383fbacd905522f0c95ad6c85a3b43e ↗
- https://git.kernel.org/stable/c/7090818ba774d254eba80979c2d4da23d91de02f ↗
- https://git.kernel.org/stable/c/ab1a8a3c9971200938093370da4c67d4427c25f2 ↗
- https://git.kernel.org/stable/c/b8abc760fa18a389319d977834a30550b3ec18e8 ↗
- https://git.kernel.org/stable/c/9b046de62b8098af6e2ba820b125ec9dc5f162c8 ↗
- https://git.kernel.org/stable/c/134f235e0e8de54611a72d3cc3f63e5f31246baa ↗
- https://git.kernel.org/stable/c/4e2c7f7cbc27418f9a290399b986c1b85ff93b90 ↗