CVE-2020-8834

KVM in the Linux kernel on Power8 processors has a conflicting use of HSTATE_HOST_R1 to store r1 state in kvmppc_hv_entry plus in kvmppc_{save,restore}_tm, leading to a stack corruption. Because of this, an attacker with the ability run code in kernel space of a guest VM can cause the host kernel to panic. There were two commits that, according to the reporter, introduced the vulnerability: f024ee098476 ("KVM: PPC: Book3S HV: Pull out TM state save/restore into separate procedures") 87a11bb6a7f7 ("KVM: PPC: Book3S HV: Work around XER[SO] bug in fake suspend mode") The former landed in 4.8, the latter in 4.17. This was fixed without realizing the impact in 4.18 with the following three commits, though it's believed the first is the only strictly necessary commit: 6f597c6b63b6 ("KVM: PPC: Book3S PR: Add guest MSR parameter for kvmppc_save_tm()/kvmppc_restore_tm()") 7b0e827c6970 ("KVM: PPC: Book3S HV: Factor fake-suspend handling out of kvmppc_save/restore_tm") 009c872a8bc4 ("KVM: PPC: Book3S PR: Move kvmppc_save_tm/kvmppc_restore_tm to separate file")

• CWE-368
• CWE-362

• http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00035.htmlMailing List, Third Party Advisory
• https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1867717Exploit, Third Party Advisory
• https://usn.ubuntu.com/4318-1/Third Party Advisory
• https://usn.ubuntu.com/usn/usn-4318-1Third Party Advisory
• https://www.openwall.com/lists/oss-security/2020/04/06/2Mailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2020-04/msg00035.htmlMailing List, Third Party Advisory
• https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1867717Exploit, Third Party Advisory
• https://usn.ubuntu.com/4318-1/Third Party Advisory
• https://usn.ubuntu.com/usn/usn-4318-1Third Party Advisory
• https://www.openwall.com/lists/oss-security/2020/04/06/2Mailing List, Third Party Advisory

Published

Apr 9, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-8828As of v1.5.0, the default admin password is set to the argoc…8.8
• CVE-2020-8829CSRF on Intelbras CIP 92200 devices allows an attacker to ac…8.8
• CVE-2020-8830CSRF in login.asp on Ruckus devices allows an attacker to ac…8.8
• CVE-2020-8831Apport creates a world writable lock file with root ownershi…5.5
• CVE-2020-8832The fix for the Linux kernel in Ubuntu 18.04 LTS for CVE-201…5.5
• CVE-2020-8833Time-of-check Time-of-use Race Condition vulnerability on cr…4.7
• CVE-2020-8835In the Linux kernel 5.5.0 and newer, the bpf verifier (kerne…7.8
• CVE-2020-8838An issue was discovered in Zoho ManageEngine AssetExplorer 6…6.4
• CVE-2020-8839Stored XSS was discovered on CHIYU BF-430 232/485 TCP/IP Con…6.1
• CVE-2020-8840FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks cert…9.8
• CVE-2020-8841An issue was discovered in TestLink 1.9.19. The relation_typ…8.8
• CVE-2020-8842Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…