Re: CVE Request: Linux x86_64 NT flag issue - Linux kernel

[cve-assign () mitre org]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

> > Use CVE-2015-6666.

> I think this may be a false alarm.  SDM Volume 3 6.12.1.2 says:
>
> On calls to exception and interrupt handlers, the processor also
> clears the VM, RF, and NT flags in the EFLAGS register, after
> they are saved on the stack.
>
> So if an interrupt or page fault happened while NT was incorrectly
> set, the NT flag would still be clear when context switching and would
> therefore never leak. (This wouldn't have been the case before 3.19,
> when we could context switch by calling schedule() directly while NT
> was set, but those kernels manually saved and restored flags across
> context switches.)

We have not seen any further discussion of this. Our understanding is
that this "might be able to leak NT into an unrelated task" security
impact was not found to affect any version of the Linux kernel. Unless
there is other information, we will move CVE-2015-6666 into the
"rejected" state later this week.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCAAGBQJV9x+yAAoJEL54rhJi8gl517kP/0veNuawDhSguGeXOrtzKv/k
d6+CJJZq4YUUAhOJ5ZdWL0TeLqN0FRaDsAhcs6SgmCNjKTWtq4diZcGPI3dElNfC
bLjmrsvJ3cWF2mk1JRUHgLhOnNj4pCOTbLQGknKKORZbBV3nH55WZhLNicqahkJL
qrUnPC05yRxI/xHmKLWu8Ic7W4s2jhz74F1se64t5qgdlekhQc9VqrXMvuzJhq+t
SAODGrf6c4fwjhhPT/XPXDq2aqa0wGkvF4usS8Kxgp2g6cBuH39UZ54e5istzV79
v1k8lwS+AnG6/W7od8sVzE3QahRr/ia7EDnurvUEC9AbkLF7qWr2+zhkvgsbx9UU
r6jPWpQbNkrZMZdVEH3lwDNsMGOiuB6E1W+2BTXJB+HSo/4IBd8JuF9JOP07E3ye
p5hb5u34P/WSXa3D+B3HukRB5aYK3KnoY0F9Fu0RT/f/v/OFZnwzyfrmAzLGI44c
dlw3kjQXEayFi8V6816YODZnKQHk4z2EwvrK7Jeu0bP1wnn/xvToWapVVLIaQ0wK
ojsATC/5KxLTJzc888++/aIlgpomGlmDBZVgpEImAc9Hr50V3gm5u1QZeAcGy4h6
Um6f1USBtnmDiebA8N2ITF3Vh55AzsmyX2vRKg382soaw8TKWVygXLwLrPE/1VXh
PvwowWLecM0VCnO6nqoT
=N5KU
-----END PGP SIGNATURE-----