CVE-2010-0306 — Kernel vulnerability
Severity
6.5MEDIUMNVD
NVD4.1
EPSS
0.1%
top 67.63%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedFeb 12
Latest updateMay 2
Description
The x86 emulator in KVM 83, when a guest is configured for Symmetric Multiprocessing (SMP), does not use the Current Privilege Level (CPL) and I/O Privilege Level (IOPL) to restrict instruction execution, which allows guest OS users to cause a denial of service (guest OS crash) or gain privileges on the guest OS by leveraging access to a (1) IO port or (2) MMIO region, and replacing an instruction in between emulator entry and instruction fetch, a related issue to CVE-2010-0298.
CVSS vector
AV:L/AC:M/C:P/I:P/A:PExploitability: 2.7 | Impact: 6.4
Affected Packages2 packages
Also affects: Debian Linux 5.0
🔴Vulnerability Details
2GHSA▶
GHSA-h7hj-hjcj-pwpj: The x86 emulator in KVM 83 does not use the Current Privilege Level (CPL) and I/O Privilege Level (IOPL) in determining the memory access available to↗2022-05-02
GHSA▶
GHSA-xpcm-5q5j-h76x: The x86 emulator in KVM 83, when a guest is configured for Symmetric Multiprocessing (SMP), does not use the Current Privilege Level (CPL) and I/O Pri↗2022-05-02