medium 6.5

CVE-2020-8834 json

Linux kernel KVM Power8 conflicting use of HSTATE_HOST_R1

published 2020-04-09 6 y ago modified 2026-06-17 4 mo ago also EUVD-2020-29677

cvss: 6.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 28%
public exploits: 0; none known

KVM in the Linux kernel on Power8 processors has a conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry plus in kvmppc_{save,restore}_tm, leading to a stack corruption. Because of this, an attacker with the ability run code in kernel space of a guest VM can cause the host kernel to panic. There were two commits that, according to the reporter, introduced the vulnerability: f024ee098476 ("KVM: PPC: Book3S HV: Pull out TM state save/restore into separate procedures") 87a11bb6a7f7 ("KVM: PPC: Book3S HV: Work around XER[SO] bug in fake suspend mode") The former landed in 4.8, the latter in 4.17. This was fixed without realizing the impact in 4.18 with the following three commits, though it's believed the first is the only strictly necessary commit: 6f597c6b63b6 ("KVM: PPC: Book3S PR: Add guest MSR parameter for kvmppc_save_tm()/kvmppc_restore_tm()") 7b0e827c6970 ("KVM: PPC: Book3S HV: Factor fake-suspend handling out of kvmppc_save/restore_tm") 009c872a8bc4 ("KVM: PPC: Book3S PR: Move kvmppc_save_tm/kvmppc_restore_tm to separate file")

Patch / fix

fixed in 1 distros 5

Linux kernel Linux kernel 4.18

debian ubuntu red hat suse opensuse

linux Debian 14, Debian 13, Debian 12 4.18.6-1

debian advisories DEBIAN-CVE-2020-8834

linux Ubuntu 18.04 LTS 4.15.0-96.97
linux-hwe Ubuntu 16.04 LTS 4.15.0-96.97~16.04.1
linux-fips Ubuntu Pro FIPS-updates 18.04 LTS 4.15.0-1029.34
linux-aws-fips Ubuntu Pro FIPS-updates 18.04 LTS 4.15.0-2018.18
linux-azure-fips Ubuntu Pro FIPS-updates 18.04 LTS 4.15.0-2006.7

ubuntu advisories UBUNTU-CVE-2020-8834

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

kernel-alt RHEL 7 4.14.0-115.26.1.el7a
perf RHEL 7 4.14.0-115.26.1.el7a
kernel RHEL 7 4.14.0-115.26.1.el7a
python-perf RHEL 7 4.14.0-115.26.1.el7a
kernel-tools RHEL 7 4.14.0-115.26.1.el7a
kernel-tools-libs RHEL 7 4.14.0-115.26.1.el7a
kernel-bootwrapper RHEL 7 4.14.0-115.26.1.el7a
kernel-abi-whitelists RHEL 7 4.14.0-115.26.1.el7a

red hat advisories RHSA-2020:2854

kernel-syms SLES for SAP 15, SLES 15-LTSS, SLE High Performance Computing 15-LTSS +1 more 4.12.14-150.52.1
kernel-source SLES for SAP 15, SLES 15-LTSS, SLE High Performance Computing 15-LTSS +1 more 4.12.14-150.52.1
kernel-default SLES for SAP 15, SLES 15-LTSS, SLE Live Patching 15 +3 more 4.12.14-150.52.1
kernel-vanilla SLES for SAP 15, SLES 15-LTSS, SLE High Performance Computing 15-LTSS +1 more 4.12.14-150.52.1
kernel-obs-build SLES for SAP 15, SLES 15-LTSS, SLE High Performance Computing 15-LTSS +1 more 4.12.14-150.52.1
kernel-syms SLE Module for Development Tools 15 SP1 4.12.14-197.40.1
kernel-source SLE Module for Development Tools 15 SP1, SLE Module for Basesystem 15 SP1 4.12.14-197.40.1
kernel-default SLE Workstation Extension 15 SP1, SLE Module for Legacy 15 SP1, SLE Module for Basesystem 15 SP1 +2 more 4.12.14-197.40.1

suse advisories SUSE-SU-2020:1663-1 SUSE-SU-2020:1146-1 SUSE-SU-2020:1142-1 SUSE-SU-2020:1141-1 SUSE-SU-2020:1123-1 SUSE-SU-2020:1119-1

kernel-syms openSUSE Leap 15.1 4.12.14-lp151.28.48.1
kernel-obs-qa openSUSE Leap 15.1 4.12.14-lp151.28.48.1
kernel-source openSUSE Leap 15.1 4.12.14-lp151.28.48.1
kernel-default openSUSE Leap 15.1 4.12.14-lp151.28.48.1
kernel-vanilla openSUSE Leap 15.1 4.12.14-lp151.28.48.1
kernel-kvmsmall openSUSE Leap 15.1 4.12.14-lp151.28.48.1
kernel-obs-build openSUSE Leap 15.1 4.12.14-lp151.28.48.1

opensuse advisories openSUSE-SU-2020:0543-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-8834 updated 2026-11-07 cvss 6.0

Kernel: ppc: kvm: conflicting use of HSTATE_HOST_R1 to store r1 state leads to host stack corruption

Red Hat Enterprise Linux 7 perf, kernel, bpftool, python-perf, kernel-kdump, kernel-tools, +3 more
affected: no fix available
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) perf 4.14.0-115.26.1.el7a, kernel 4.14.0-115.26.1.el7a, kernel-alt 4.14.0-115.26.1.el7a, python-perf 4.14.0-115.26.1.el7a, kernel-tools 4.14.0-115.26.1.el7a, kernel-tools-libs 4.14.0-115.26.1.el7a, +3 more Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) kernel-debuginfo-common-ppc64le 4.14.0-115.26.1.el7a
fixed: vendor fix RHSA-2020:2854
Red Hat Enterprise Linux 5 kernel Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 kernel-rt, kernel-rt-kvm, kernel-rt-trace, kernel-rt-debug-kvm, kernel-rt-trace-kvm Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) kernel-headers 4.14.0-115.26.1.el7a Red Hat Enterprise MRG 2 kernel
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

0.35% chance of exploitation in the next 30 days, higher than 28% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

bugs.launchpad.net https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1867717 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	6.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
NVD	3.1	6.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
NVD	2.0	4.9	AV:L/AC:L/Au:N/C:N/I:N/A:C

Affected products

Linux kernel Linux kernel

Classification

Weakness

CWE-368 Context Switching Race Condition
CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization

Technology feeds

Linux kernel rss critical rss

References

bugs.launchpad.net /ubuntu/+source/linux/+bug/1867717
exploit, third-party-advisory
usn.ubuntu.com /4318-1/
vendor-advisory, third-party-advisory
lists.opensuse.org /opensuse-security-announce/2020-04/msg00035.html
vendor-advisory, mailing-list, third-party-advisory
openwall.com /lists/oss-security/2020/04/06/2
mailing-list, third-party-advisory
usn.ubuntu.com /usn/usn-4318-1
third-party-advisory

Sources

CVE List CVE-2020-8834
NVD CVE-2020-8834

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary