Executive Summary
Summary | |
---|---|
Title | kvm security update |
Informations | |||
---|---|---|---|
Name | RHSA-2013:0727 | First vendor Publication | 2013-04-09 |
Vendor | RedHat | Last vendor Modification | 2013-04-09 |
Severity (Vendor) | Important | Revision | 01 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:A/AC:H/Au:N/C:C/I:C/A:C) | |||
---|---|---|---|
Cvss Base Score | 6.8 | Attack Range | Adjacent network |
Cvss Impact Score | 10 | Attack Complexity | High |
Cvss Expoit Score | 3.2 | Authentication | None Required |
Calculate full CVSS 2.0 Vectors scores |
Detail
Problem Description: Updated kvm packages that fix three security issues are now available for Red Hat Enterprise Linux 5. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: RHEL Desktop Multi OS (v. 5 client) - x86_64 RHEL Virtualization (v. 5 server) - x86_64 3. Description: KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on AMD64 and Intel 64 systems. KVM is a Linux kernel module built for the standard Red Hat Enterprise Linux kernel. A flaw was found in the way KVM handled guest time updates when the buffer the guest registered by writing to the MSR_KVM_SYSTEM_TIME machine state register (MSR) crossed a page boundary. A privileged guest user could use this flaw to crash the host or, potentially, escalate their privileges, allowing them to execute arbitrary code at the host kernel level. (CVE-2013-1796) A potential use-after-free flaw was found in the way KVM handled guest time updates when the GPA (guest physical address) the guest registered by writing to the MSR_KVM_SYSTEM_TIME machine state register (MSR) fell into a movable or removable memory region of the hosting user-space process (by default, QEMU-KVM) on the host. If that memory region is deregistered from KVM using KVM_SET_USER_MEMORY_REGION and the allocated virtual memory reused, a privileged guest user could potentially use this flaw to escalate their privileges on the host. (CVE-2013-1797) A flaw was found in the way KVM emulated IOAPIC (I/O Advanced Programmable Interrupt Controller). A missing validation check in the ioapic_read_indirect() function could allow a privileged guest user to crash the host, or read a substantial portion of host kernel memory. (CVE-2013-1798) Red Hat would like to thank Andrew Honig of Google for reporting all of these issues. All users of kvm are advised to upgrade to these updated packages, which contain backported patches to correct these issues. Note that the procedure in the Solution section must be performed before this update will take effect. 4. Solution: Before applying this update, make sure all previously-released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258 The following procedure must be performed before this update will take effect: 1) Stop all KVM guest virtual machines. 2) Either reboot the hypervisor machine or, as the root user, remove (using "modprobe -r [module]") and reload (using "modprobe [module]") all of the following modules which are currently running (determined using "lsmod"): kvm, ksm, kvm-intel or kvm-amd. 3) Restart the KVM guest virtual machines. 5. Bugs fixed (http://bugzilla.redhat.com/): 917012 - CVE-2013-1796 kernel: kvm: buffer overflow in handling of MSR_KVM_SYSTEM_TIME 917013 - CVE-2013-1797 kernel: kvm: after free issue with the handling of MSR_KVM_SYSTEM_TIME 917017 - CVE-2013-1798 kernel: kvm: out-of-bounds access in ioapic indirect register reads |
Original Source
Url : https://rhn.redhat.com/errata/RHSA-2013-0727.html |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
33 % | CWE-399 | Resource Management Errors |
33 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
33 % | CWE-20 | Improper Input Validation |
OVAL Definitions
Definition Id: oval:org.mitre.oval:def:17718 | |||
Oval ID: | oval:org.mitre.oval:def:17718 | ||
Title: | USN-1808-1 -- linux-ec2 vulnerabilities | ||
Description: | Several security issues were fixed in the kernel. | ||
Family: | unix | Class: | patch |
Reference(s): | USN-1808-1 CVE-2012-6542 CVE-2012-6544 CVE-2012-6545 CVE-2012-6546 CVE-2012-6548 CVE-2013-0228 CVE-2013-0349 CVE-2013-1774 CVE-2013-1796 | Version: | 7 |
Platform(s): | Ubuntu 10.04 | Product(s): | linux-ec2 |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:20911 | |||
Oval ID: | oval:org.mitre.oval:def:20911 | ||
Title: | RHSA-2013:0727: kvm security update (Important) | ||
Description: | The ioapic_read_indirect function in virt/kvm/ioapic.c in the Linux kernel through 3.8.4 does not properly handle a certain combination of invalid IOAPIC_REG_SELECT and IOAPIC_REG_WINDOW operations, which allows guest OS users to obtain sensitive information from host OS memory or cause a denial of service (host OS OOPS) via a crafted application. | ||
Family: | unix | Class: | patch |
Reference(s): | RHSA-2013:0727-00 CESA-2013:0727 CVE-2013-1796 CVE-2013-1797 CVE-2013-1798 | Version: | 45 |
Platform(s): | Red Hat Enterprise Linux 5 CentOS Linux 5 | Product(s): | kvm |
Definition Synopsis: | |||
|
Definition Id: oval:org.mitre.oval:def:22550 | |||
Oval ID: | oval:org.mitre.oval:def:22550 | ||
Title: | ELSA-2013:0727: kvm security update (Important) | ||
Description: | The ioapic_read_indirect function in virt/kvm/ioapic.c in the Linux kernel through 3.8.4 does not properly handle a certain combination of invalid IOAPIC_REG_SELECT and IOAPIC_REG_WINDOW operations, which allows guest OS users to obtain sensitive information from host OS memory or cause a denial of service (host OS OOPS) via a crafted application. | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2013:0727-00 CVE-2013-1796 CVE-2013-1797 CVE-2013-1798 | Version: | 17 |
Platform(s): | Oracle Linux 5 | Product(s): | kvm |
Definition Synopsis: | |||
Definition Id: oval:org.mitre.oval:def:27090 | |||
Oval ID: | oval:org.mitre.oval:def:27090 | ||
Title: | DEPRECATED: ELSA-2013-0727 -- kvm security update (important) | ||
Description: | [kvm-83-262.0.1.el5_9.3] - Added kvm-add-oracle-workaround-for-libvirt-bug.patch - Added kvm-Introduce-oel-machine-type.patch [kvm-83-262.el5_3] - kvm-kernel-kvm-accept-unaligned-MSR_KVM_SYSTEM_TIME-writes.patch [bz#947363] - Resolves: bz#947363 (RHEL.5.8.32 guest hang when installing) [kvm-83-262.el5_2] - kvm-kernel-KVM-Fix-for-buffer-overflow-in-handling-of-MSR_KVM_S.patch [bz#917018] - kvm-kernel-KVM-Convert-MSR_KVM_SYSTEM_TIME-to-use-kvm_write_gue.patch [bz#917022] - kvm-kernel-KVM-Fix-bounds-checking-in-ioapic-indirect-register-.patch [bz#917028] - kvm-kernel-do-not-GP-on-unaligned-MSR_KVM_SYSTEM_TIME-write.patch [bz#bz917019] - Resolves: bz#917018 (CVE-2013-1796 kernel: kvm: buffer overflow in handling of MSR_KVM_SYSTEM_TIME [rhel-5.9.z]) - Resolves: bz#917022 (CVE-2013-1797 kernel: kvm: after free issue with the handling of MSR_KVM_SYSTEM_TIME [rhel-5.9.z]) - Resolves: bz#917028 (CVE-2013-1798 kernel: kvm: out-of-bounds access in ioapic indirect register reads [rhel-5.9.z]) | ||
Family: | unix | Class: | patch |
Reference(s): | ELSA-2013-0727 CVE-2013-1796 CVE-2013-1798 CVE-2013-1797 | Version: | 4 |
Platform(s): | Oracle Linux 5 | Product(s): | kvm |
Definition Synopsis: | |||
CPE : Common Platform Enumeration
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2015-05-20 | Name : The remote SUSE host is missing one or more security updates. File : suse_SU-2014-0287-1.nasl - Type : ACT_GATHER_INFO |
2014-11-08 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2013-1026.nasl - Type : ACT_GATHER_INFO |
2014-11-08 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2013-0928.nasl - Type : ACT_GATHER_INFO |
2014-11-08 | Name : The remote Red Hat host is missing a security update. File : redhat-RHSA-2013-0746.nasl - Type : ACT_GATHER_INFO |
2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2013-398.nasl - Type : ACT_GATHER_INFO |
2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2013-440.nasl - Type : ACT_GATHER_INFO |
2014-06-13 | Name : The remote openSUSE host is missing a security update. File : openSUSE-2013-454.nasl - Type : ACT_GATHER_INFO |
2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2013-2525.nasl - Type : ACT_GATHER_INFO |
2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2013-2534.nasl - Type : ACT_GATHER_INFO |
2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2013-2523.nasl - Type : ACT_GATHER_INFO |
2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2013-2520.nasl - Type : ACT_GATHER_INFO |
2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2013-2519.nasl - Type : ACT_GATHER_INFO |
2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2013-0744.nasl - Type : ACT_GATHER_INFO |
2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2013-0727.nasl - Type : ACT_GATHER_INFO |
2013-06-25 | Name : The remote Mandriva Linux host is missing one or more security updates. File : mandriva_MDVSA-2013-176.nasl - Type : ACT_GATHER_INFO |
2013-06-16 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-1877-1.nasl - Type : ACT_GATHER_INFO |
2013-06-16 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1876-1.nasl - Type : ACT_GATHER_INFO |
2013-05-17 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2669.nasl - Type : ACT_GATHER_INFO |
2013-05-15 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2668.nasl - Type : ACT_GATHER_INFO |
2013-05-08 | Name : The remote SuSE 11 host is missing one or more security updates. File : suse_11_kernel-130426.nasl - Type : ACT_GATHER_INFO |
2013-05-03 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1813-1.nasl - Type : ACT_GATHER_INFO |
2013-05-02 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1809-1.nasl - Type : ACT_GATHER_INFO |
2013-05-02 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-1812-1.nasl - Type : ACT_GATHER_INFO |
2013-04-26 | Name : The remote Ubuntu host is missing a security-related patch. File : ubuntu_USN-1808-1.nasl - Type : ACT_GATHER_INFO |
2013-04-25 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2013-0744.nasl - Type : ACT_GATHER_INFO |
2013-04-25 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20130423_kernel_on_SL6_x.nasl - Type : ACT_GATHER_INFO |
2013-04-24 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2013-0744.nasl - Type : ACT_GATHER_INFO |
2013-04-22 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1805-1.nasl - Type : ACT_GATHER_INFO |
2013-04-11 | Name : The remote CentOS host is missing one or more security updates. File : centos_RHSA-2013-0727.nasl - Type : ACT_GATHER_INFO |
2013-04-10 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20130409_kvm_on_SL5_x.nasl - Type : ACT_GATHER_INFO |
2013-04-10 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2013-0727.nasl - Type : ACT_GATHER_INFO |
2013-04-01 | Name : The remote Fedora host is missing a security update. File : fedora_2013-4357.nasl - Type : ACT_GATHER_INFO |
2013-03-24 | Name : The remote Fedora host is missing a security update. File : fedora_2013-4240.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2014-02-17 11:57:07 |
|
2013-04-09 21:18:22 |
|