In the flushtmregsto_thread function in arch/powerpc/kernel/ptrace.c in the Linux kernel before 4.13.5, a guest kernel crash can be triggered from unprivileged userspace during a core dump on a POWER host due to a missing processor feature check and an erroneous use of transactional memory (TM) instructions in the core dump path, leading to a denial of service.
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2018-1091.json"
[
{
"id": "CVE-2018-1091-26c29c74",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@c1fa0768a8713b135848f78fd43ffc208d8ded70",
"target": {
"file": "arch/powerpc/kernel/ptrace.c",
"function": "flush_tmregs_to_thread"
},
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 205.0,
"function_hash": "296875033005909207643219705737050231575"
}
},
{
"id": "CVE-2018-1091-b350b3c3",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git@c1fa0768a8713b135848f78fd43ffc208d8ded70",
"target": {
"file": "arch/powerpc/kernel/ptrace.c"
},
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"204591303679979673985445841243540929947",
"231393323695694613454255636546862233661",
"182688679326694168599152973174262740600",
"170108458760201340436623743368382744346"
],
"threshold": 0.9
}
}
]
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2018-1091.json"
[
{
"id": "CVE-2018-1091-5af54ab2",
"source": "https://github.com/torvalds/linux/commit/c1fa0768a8713b135848f78fd43ffc208d8ded70",
"target": {
"file": "arch/powerpc/kernel/ptrace.c",
"function": "flush_tmregs_to_thread"
},
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"digest": {
"length": 205.0,
"function_hash": "296875033005909207643219705737050231575"
}
},
{
"id": "CVE-2018-1091-76fcbbff",
"source": "https://github.com/torvalds/linux/commit/c1fa0768a8713b135848f78fd43ffc208d8ded70",
"target": {
"file": "arch/powerpc/kernel/ptrace.c"
},
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"digest": {
"line_hashes": [
"204591303679979673985445841243540929947",
"231393323695694613454255636546862233661",
"182688679326694168599152973174262740600",
"170108458760201340436623743368382744346"
],
"threshold": 0.9
}
}
]