CVE-2010-0298
published 2010-02-12CVE-2010-0298: The x86 emulator in KVM 83 does not use the Current Privilege Level (CPL) and I/O Privilege Level (IOPL) in determining the memory access available to CPL3…
PriorityP427medium6.5CVSS 2.0
AVNACLAuSCPIPAP
EPSS
2.42%
82.5th percentile
The x86 emulator in KVM 83 does not use the Current Privilege Level (CPL) and I/O Privilege Level (IOPL) in determining the memory access available to CPL3 code, which allows guest OS users to cause a denial of service (guest OS crash) or gain privileges on the guest OS by leveraging access to a (1) IO port or (2) MMIO region, a related issue to CVE-2010-0306.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| kvm_qumranet | kvm | — | — |
| linux | linux_kernel | 2.6.28 – 2.6.33 | — |
CVSS provenance
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
vendor_redhat6.5MEDIUM
vendor_ubuntu4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-h7hj-hjcj-pwpj: The x86 emulator in KVM 83 does not use the Current Privilege Level (CPL) and I/O Privilege Level (IOPL) in determining the memory access available to
ghsa_unreviewed·2022-05-02·CVSS 4.1
CVE-2010-0298 [MEDIUM] GHSA-h7hj-hjcj-pwpj: The x86 emulator in KVM 83 does not use the Current Privilege Level (CPL) and I/O Privilege Level (IOPL) in determining the memory access available to
The x86 emulator in KVM 83 does not use the Current Privilege Level (CPL) and I/O Privilege Level (IOPL) in determining the memory access available to CPL3 code, which allows guest OS users to cause a denial of service (guest OS crash) or gain privileges on the guest OS by leveraging access to a (1) IO port or (2) MMIO region, a related issue to CVE-2010-0306.
GHSA
GHSA-xpcm-5q5j-h76x: The x86 emulator in KVM 83, when a guest is configured for Symmetric Multiprocessing (SMP), does not use the Current Privilege Level (CPL) and I/O Pri
ghsa_unreviewed·2022-05-02·CVSS 6.5
CVE-2010-0306 [MEDIUM] GHSA-xpcm-5q5j-h76x: The x86 emulator in KVM 83, when a guest is configured for Symmetric Multiprocessing (SMP), does not use the Current Privilege Level (CPL) and I/O Pri
The x86 emulator in KVM 83, when a guest is configured for Symmetric Multiprocessing (SMP), does not use the Current Privilege Level (CPL) and I/O Privilege Level (IOPL) to restrict instruction execution, which allows guest OS users to cause a denial of service (guest OS crash) or gain privileges on the guest OS by leveraging access to a (1) IO port or (2) MMIO region, and replacing an instruction in between emulator entry and instruction fetch, a related issue to CVE-2010-0298.
Ubuntu
Linux kernel regression
vendor_ubuntu·2010-06-04·CVSS 4.7
CVE-2010-0419 [MEDIUM] Linux kernel regression
Title: Linux kernel regression
Summary: KVM regressed under some conditions in the Linux kernel.
USN-947-1 fixed vulnerabilities in the Linux kernel. Fixes for
CVE-2010-0419 caused failures when using KVM in certain situations.
This update reverts that fix until a better solution can be found.
We apologize for the inconvenience.
Original advisory details:
It was discovered that the Linux kernel did not correctly handle memory
protection of the Virtual Dynamic Shared Object page when running
a 32-bit application on a 64-bit kernel. A local attacker could
exploit this to cause a denial of service. (Only affected Ubuntu 6.06
LTS.) (CVE-2009-4271)
It was discovered that the r8169 network driver did not correctly check
the size of Ethernet frames. A remote attacker could send specially
cr
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2010-06-03·CVSS 4.7
CVE-2009-4271 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Multiple flaws in the Linux kernel.
It was discovered that the Linux kernel did not correctly handle memory
protection of the Virtual Dynamic Shared Object page when running
a 32-bit application on a 64-bit kernel. A local attacker could
exploit this to cause a denial of service. (Only affected Ubuntu 6.06
LTS.) (CVE-2009-4271)
It was discovered that the r8169 network driver did not correctly check
the size of Ethernet frames. A remote attacker could send specially
crafted traffic to crash the system, leading to a denial of service.
(CVE-2009-4537)
Wei Yongjun discovered that SCTP did not correctly validate certain
chunks. A remote attacker could send specially crafted traffic to
monopolize CPU resources, leading to a denial of service. (Onl
Red Hat
kvm: emulator privilege escalation IOPL/CPL level check
vendor_redhat·2010-02-09·CVSS 6.5
CVE-2010-0306 [MEDIUM] kvm: emulator privilege escalation IOPL/CPL level check
kvm: emulator privilege escalation IOPL/CPL level check
The x86 emulator in KVM 83, when a guest is configured for Symmetric Multiprocessing (SMP), does not use the Current Privilege Level (CPL) and I/O Privilege Level (IOPL) to restrict instruction execution, which allows guest OS users to cause a denial of service (guest OS crash) or gain privileges on the guest OS by leveraging access to a (1) IO port or (2) MMIO region, and replacing an instruction in between emulator entry and instruction fetch, a related issue to CVE-2010-0298.
Red Hat
kvm: emulator privilege escalation
vendor_redhat·2010-02-09·CVSS 6.5
CVE-2010-0298 [MEDIUM] kvm: emulator privilege escalation
kvm: emulator privilege escalation
The x86 emulator in KVM 83 does not use the Current Privilege Level (CPL) and I/O Privilege Level (IOPL) in determining the memory access available to CPL3 code, which allows guest OS users to cause a denial of service (guest OS crash) or gain privileges on the guest OS by leveraging access to a (1) IO port or (2) MMIO region, a related issue to CVE-2010-0306.
Suricata
GPL FTP RETR overflow attempt
suricata·2010-09-23
CVE-2003-0466 GPL FTP RETR overflow attempt
GPL FTP RETR overflow attempt
Rule: alert tcp $EXTERNAL_NET any -> $HOME_NET 21 (msg:"GPL FTP RETR overflow attempt"; flow:established,to_server; content:"RETR"; nocase; isdataat:100,relative; pcre:"/^RETR\s[^\n]{100}/smi"; reference:bugtraq,8315; reference:cve,2003-0466; reference:cve,2004-0287; reference:cve,2004-0298; classtype:attempted-admin; sid:2102392; rev:9; metadata:created_at 2010_09_23, cve CVE_2003_0466, confidence Medium, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_08;)
No public exploits indexed.
http://secunia.com/advisories/38492http://www.debian.org/security/2010/dsa-1996http://www.securityfocus.com/bid/38158https://bugzilla.redhat.com/show_bug.cgi?id=559091https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11335https://rhn.redhat.com/errata/RHSA-2010-0088.htmlhttps://rhn.redhat.com/errata/RHSA-2010-0095.htmlhttp://secunia.com/advisories/38492http://www.debian.org/security/2010/dsa-1996http://www.securityfocus.com/bid/38158https://bugzilla.redhat.com/show_bug.cgi?id=559091https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11335https://rhn.redhat.com/errata/RHSA-2010-0088.htmlhttps://rhn.redhat.com/errata/RHSA-2010-0095.html
2010-02-12
Published