crypto/vmx/p8_ghash memory corruption
| Affects | Status | Importance | Assigned to | Milestone | |
|---|---|---|---|---|---|
| linux (Ubuntu) |
Fix Released
|
Undecided
|
Marcelo Cerri | ||
| Xenial |
Fix Released
|
Undecided
|
Marcelo Cerri | ||
| Yakkety |
Fix Released
|
Undecided
|
Marcelo Cerri | ||
Bug Description
That bug was reported on the linux-crypto mailing list by Jan Stancek. The bug is not easily reproduced on Xenial because the crypto API test manager is not enabled and the hash test that exorcises this bug is not present on the Xenial kernel.
---
Hi,
I'm chasing a memory corruption with 4.8-rc7 as I'm observing random Oopses
on ppc BE/LE systems (lpars, KVM guests). About 30% of issues is that
module list gets corrupted, and "cat /proc/modules" or "lsmod" triggers
an Oops, for example:
[ 88.486041] Unable to handle kernel paging request for data at address 0x00000020
...
[ 88.487658] NIP [c00000000020f820] m_show+0xa0/0x240
[ 88.487689] LR [c00000000020f834] m_show+0xb4/0x240
[ 88.487719] Call Trace:
[ 88.487736] [c0000004b605bbb0] [c00000000020f834] m_show+0xb4/0x240 (unreliable)
[ 88.487796] [c0000004b605bc50] [c00000000045e73c] seq_read+
[ 88.487843] [c0000004b605bcf0] [c0000000004e1014] proc_reg_
[ 88.487889] [c0000004b605bd30] [c00000000040df88] vfs_read+0xf8/0x380
[ 88.487934] [c0000004b605bde0] [c00000000040fd40] SyS_read+0x60/0x110
[ 88.487981] [c0000004b605be30] [c000000000009590] system_
0x20 offset is module_use->source, module_use is NULL because module.source_list
gets corrupted.
The source of corruption appears to originate from a 'ahash' test for p8_ghash:
cryptomgr_test
alg_test
alg_test_hash
test_hash
__test_hash
ahash_
shash_
memcpy
With some extra traces [1], I'm seeing that ahash_partial_
for 'state', and then crypto_
[ 5.970887] __test_hash alg name p8_ghash, result: c000000004333ac0, key: c0000004b860a500, req: c0000004b860a380
[ 5.970963] state: c000000004333f00, statesize: 56
[ 5.970995] shash_default_
This seems to directly correspond with:
p8_ghash_
shash_
where 20 is presumably coming from "ghash_
My gut feeling was that these 2 should match, but I'd love to hear
what crypto people think.
Thank you,
Jan
---
CVE References
| summary: |
- https://www.google.com/search?q=999999999999999+-+999999999999998&rlz=1CADEAC_enUS712US712&oq=999999999999999+-+999999999999998&aqs=chrome..69i57j69i64.260j0j7&sourceid=chrome&ie=UTF-8 + crypto/vmx/p8_ghash memory corruption |
| Changed in linux (Ubuntu): | |
| status: | New → Confirmed |
| Changed in linux (Ubuntu Xenial): | |
| assignee: | nobody → Marcelo Cerri (mhcerri) |
| status: | New → Confirmed |
| Changed in linux (Ubuntu Yakkety): | |
| status: | Confirmed → Fix Committed |
| Changed in linux (Ubuntu Xenial): | |
| status: | Confirmed → Fix Committed |
| Seth Forshee (sforshee) wrote | #1 |
| tags: | added: verification-needed-xenial |
| tags: | added: verification-needed-yakkety |
| Seth Forshee (sforshee) wrote | #2 |
| tags: |
added: verification-done-xenial verification-done-yakkety removed: verification-needed-xenial verification-needed-yakkety |
| Launchpad Janitor (janitor) wrote | #3 |
| Changed in linux (Ubuntu Xenial): | |
| status: | Fix Committed → Fix Released |
| Launchpad Janitor (janitor) wrote | #4 |
| Changed in linux (Ubuntu Yakkety): | |
| status: | Fix Committed → Fix Released |
| Launchpad Janitor (janitor) wrote | #5 |
| Changed in linux (Ubuntu): | |
| status: | Fix Committed → Fix Released |
This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-
If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.
See https:/