CVE-2013-6368
published 2013-12-14CVE-2013-6368: The KVM subsystem in the Linux kernel through 3.12.5 allows local users to gain privileges or cause a denial of service (system crash) via a VAPIC…
PriorityP422medium6.2CVSS 2.0
AVLACHAuNCCICAC
EPSS
0.61%
45.3th percentile
The KVM subsystem in the Linux kernel through 3.12.5 allows local users to gain privileges or cause a denial of service (system crash) via a VAPIC synchronization operation involving a page-end address.
Affected
248 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 3.12.5-1 (bookworm) | linux 3.12.5-1 (bookworm) |
| linux | linux_kernel | <= 3.12.5 | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
CVSS provenance
nvdv2.06.2MEDIUMAV:L/AC:H/Au:N/C:C/I:C/A:C
osv6.2MEDIUM
vendor_ubuntu7.1HIGH
vendor_debian6.2MEDIUM
vendor_redhat6.2MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel (OMAP4) vulnerabilities
vendor_ubuntu·2014-03-07·CVSS 4.3
CVE-2013-4579 [MEDIUM] Linux kernel (OMAP4) vulnerabilities
Title: Linux kernel (OMAP4) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Mathy Vanhoef discovered an error in the the way the ath9k driver was
handling the BSSID masking. A remote attacker could exploit this error to
discover the original MAC address after a spoofing atack. (CVE-2013-4579)
Andrew Honig reported a flaw in the Linux Kernel's kvm_vm_ioctl_create_vcpu
function of the Kernel Virtual Machine (KVM) subsystem. A local user could
exploit this flaw to gain privileges on the host machine. (CVE-2013-4587)
Andrew Honig reported a flaw in the apic_get_tmcct function of the Kernel
Virtual Machine (KVM) subsystem if the Linux kernel. A guest OS user could
exploit this flaw to cause a denial of service or host OS system crash.
(CVE-2013-6367)
Andrew Honig
Ubuntu
Linux kernel (OMAP4) vulnerabilities
vendor_ubuntu·2014-03-07·CVSS 4.3
CVE-2013-4579 [MEDIUM] Linux kernel (OMAP4) vulnerabilities
Title: Linux kernel (OMAP4) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Mathy Vanhoef discovered an error in the the way the ath9k driver was
handling the BSSID masking. A remote attacker could exploit this error to
discover the original MAC address after a spoofing atack. (CVE-2013-4579)
Andrew Honig reported a flaw in the Linux Kernel's kvm_vm_ioctl_create_vcpu
function of the Kernel Virtual Machine (KVM) subsystem. A local user could
exploit this flaw to gain privileges on the host machine. (CVE-2013-4587)
Andrew Honig reported a flaw in the apic_get_tmcct function of the Kernel
Virtual Machine (KVM) subsystem if the Linux kernel. A guest OS user could
exploit this flaw to cause a denial of service or host OS system crash.
(CVE-2013-6367)
Andrew Honig
Ubuntu
Linux kernel (OMAP4) vulnerabilities
vendor_ubuntu·2014-03-07·CVSS 4.3
CVE-2013-4579 [MEDIUM] Linux kernel (OMAP4) vulnerabilities
Title: Linux kernel (OMAP4) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Mathy Vanhoef discovered an error in the the way the ath9k driver was
handling the BSSID masking. A remote attacker could exploit this error to
discover the original MAC address after a spoofing atack. (CVE-2013-4579)
Andrew Honig reported an error in the Linux Kernel's Kernel Virtual Machine
(KVM) VAPIC synchronization operation. A local user could exploit this flaw
to gain privileges or cause a denial of service (system crash).
(CVE-2013-6368)
A flaw was discovered in the Reliable Datagram Sockets (RDS) protocol
implementation in the Linux kernel for systems that lack RDS transports. An
unprivileged local user could exploit this flaw to cause a denial of
service (system crash). (CVE
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2014-03-07·CVSS 4.3
CVE-2013-4579 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
Mathy Vanhoef discovered an error in the the way the ath9k driver was
handling the BSSID masking. A remote attacker could exploit this error to
discover the original MAC address after a spoofing atack. (CVE-2013-4579)
Andrew Honig reported a flaw in the Linux Kernel's kvm_vm_ioctl_create_vcpu
function of the Kernel Virtual Machine (KVM) subsystem. A local user could
exploit this flaw to gain privileges on the host machine. (CVE-2013-4587)
Andrew Honig reported a flaw in the apic_get_tmcct function of the Kernel
Virtual Machine (KVM) subsystem if the Linux kernel. A guest OS user could
exploit this flaw to cause a denial of service or host OS system crash.
(CVE-2013-6367)
Andrew Honig reporte
Ubuntu
Linux kernel (Quantal HWE) vulnerabilities
vendor_ubuntu·2014-03-07·CVSS 4.3
CVE-2013-4579 [MEDIUM] Linux kernel (Quantal HWE) vulnerabilities
Title: Linux kernel (Quantal HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Mathy Vanhoef discovered an error in the the way the ath9k driver was
handling the BSSID masking. A remote attacker could exploit this error to
discover the original MAC address after a spoofing atack. (CVE-2013-4579)
Andrew Honig reported a flaw in the Linux Kernel's kvm_vm_ioctl_create_vcpu
function of the Kernel Virtual Machine (KVM) subsystem. A local user could
exploit this flaw to gain privileges on the host machine. (CVE-2013-4587)
Andrew Honig reported a flaw in the apic_get_tmcct function of the Kernel
Virtual Machine (KVM) subsystem if the Linux kernel. A guest OS user could
exploit this flaw to cause a denial of service or host OS system crash.
(CVE-2013-6367)
Andrew
Ubuntu
Linux kernel (Raring HWE) vulnerabilities
vendor_ubuntu·2014-03-07·CVSS 4.3
CVE-2013-4579 [MEDIUM] Linux kernel (Raring HWE) vulnerabilities
Title: Linux kernel (Raring HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Mathy Vanhoef discovered an error in the the way the ath9k driver was
handling the BSSID masking. A remote attacker could exploit this error to
discover the original MAC address after a spoofing atack. (CVE-2013-4579)
Andrew Honig reported a flaw in the Linux Kernel's kvm_vm_ioctl_create_vcpu
function of the Kernel Virtual Machine (KVM) subsystem. A local user could
exploit this flaw to gain privileges on the host machine. (CVE-2013-4587)
Andrew Honig reported a flaw in the apic_get_tmcct function of the Kernel
Virtual Machine (KVM) subsystem if the Linux kernel. A guest OS user could
exploit this flaw to cause a denial of service or host OS system crash.
(CVE-2013-6367)
Andrew
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2014-03-07·CVSS 4.3
CVE-2013-4579 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
Mathy Vanhoef discovered an error in the the way the ath9k driver was
handling the BSSID masking. A remote attacker could exploit this error to
discover the original MAC address after a spoofing atack. (CVE-2013-4579)
Andrew Honig reported an error in the Linux Kernel's Kernel Virtual Machine
(KVM) VAPIC synchronization operation. A local user could exploit this flaw
to gain privileges or cause a denial of service (system crash).
(CVE-2013-6368)
A flaw was discovered in the Reliable Datagram Sockets (RDS) protocol
implementation in the Linux kernel for systems that lack RDS transports. An
unprivileged local user could exploit this flaw to cause a denial of
service (system crash). (CVE-2013-73
Ubuntu
Linux kernel (Saucy HWE) vulnerabilities
vendor_ubuntu·2014-02-18·CVSS 7.1
CVE-2013-4563 [HIGH] Linux kernel (Saucy HWE) vulnerabilities
Title: Linux kernel (Saucy HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Saran Neti reported a flaw in the ipv6 UDP Fragmentation Offload (UFI) in
the Linux kernel. A remote attacker could exploit this flaw to cause a
denial of service (panic). (CVE-2013-4563)
Mathy Vanhoef discovered an error in the the way the ath9k driver was
handling the BSSID masking. A remote attacker could exploit this error to
discover the original MAC address after a spoofing atack. (CVE-2013-4579)
Andrew Honig reported a flaw in the Linux Kernel's kvm_vm_ioctl_create_vcpu
function of the Kernel Virtual Machine (KVM) subsystem. A local user could
exploit this flaw to gain privileges on the host machine. (CVE-2013-4587)
Andrew Honig reported a flaw in the apic_get_tmcct functi
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2014-02-18·CVSS 7.1
CVE-2013-4563 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
Saran Neti reported a flaw in the ipv6 UDP Fragmentation Offload (UFI) in
the Linux kernel. A remote attacker could exploit this flaw to cause a
denial of service (panic). (CVE-2013-4563)
Mathy Vanhoef discovered an error in the the way the ath9k driver was
handling the BSSID masking. A remote attacker could exploit this error to
discover the original MAC address after a spoofing atack. (CVE-2013-4579)
Andrew Honig reported a flaw in the Linux Kernel's kvm_vm_ioctl_create_vcpu
function of the Kernel Virtual Machine (KVM) subsystem. A local user could
exploit this flaw to gain privileges on the host machine. (CVE-2013-4587)
Andrew Honig reported a flaw in the apic_get_tmcct function of the Ke
Red Hat
kvm: cross page vapic_addr access
vendor_redhat·2013-12-12·CVSS 6.2
CVE-2013-6368 [MEDIUM] kvm: cross page vapic_addr access
kvm: cross page vapic_addr access
The KVM subsystem in the Linux kernel through 3.12.5 allows local users to gain privileges or cause a denial of service (system crash) via a VAPIC synchronization operation involving a page-end address.
Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise MRG 2 as they did not provide support for the KVM subsystem.
Package: kernel (Red Hat Enterprise Linux 5) - Not affected
Package: kvm (Red Hat Enterprise Linux 5) - Affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: realtime-kernel (Red Hat Enterprise MRG 2) - Not affected
Debian
CVE-2013-6368: linux - The KVM subsystem in the Linux kernel through 3.12.5 allows local users to gain ...
vendor_debian·2013·CVSS 6.2
CVE-2013-6368 [MEDIUM] CVE-2013-6368: linux - The KVM subsystem in the Linux kernel through 3.12.5 allows local users to gain ...
The KVM subsystem in the Linux kernel through 3.12.5 allows local users to gain privileges or cause a denial of service (system crash) via a VAPIC synchronization operation involving a page-end address.
Scope: local
bookworm: resolved (fixed in 3.12.5-1)
bullseye: resolved (fixed in 3.12.5-1)
forky: resolved (fixed in 3.12.5-1)
sid: resolved (fixed in 3.12.5-1)
trixie: resolved (fixed in 3.12.5-1)
GHSA
GHSA-x9p5-w287-9fwv: The KVM subsystem in the Linux kernel through 3
ghsa_unreviewed·2022-05-14
CVE-2013-6368 [MEDIUM] CWE-20 GHSA-x9p5-w287-9fwv: The KVM subsystem in the Linux kernel through 3
The KVM subsystem in the Linux kernel through 3.12.5 allows local users to gain privileges or cause a denial of service (system crash) via a VAPIC synchronization operation involving a page-end address.
OSV
CVE-2013-6368: The KVM subsystem in the Linux kernel through 3
osv·2013-12-14·CVSS 6.2
CVE-2013-6368 [MEDIUM] CVE-2013-6368: The KVM subsystem in the Linux kernel through 3
The KVM subsystem in the Linux kernel through 3.12.5 allows local users to gain privileges or cause a denial of service (system crash) via a VAPIC synchronization operation involving a page-end address.
Kernel
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm
kernel_security·2013-12-12·CVSS 7.2
CVE-2013-4587 [HIGH] Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm
Pull kvm fixes from Paolo Bonzini:
"Four security fixes for KVM on x86. Thanks to Andrew Honig and Lars
Bull from Google for reporting them"
* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
KVM: x86: fix guest-initiated crash with x2apic (CVE-2013-6376)
KVM: x86: Convert vapic synchronization to _cached functions (CVE-2013-6368)
KVM: x86: Fix potential divide by 0 in lapic (CVE-2013-6367)
KVM: Improve create VCPU parameter (CVE-2013-4587)
Kernel
KVM: x86: Convert vapic synchronization to _cached functions (CVE-2013-6368)
kernel_security·2013-11-20·CVSS 6.2
CVE-2013-6368 [MEDIUM] KVM: x86: Convert vapic synchronization to _cached functions (CVE-2013-6368)
KVM: x86: Convert vapic synchronization to _cached functions (CVE-2013-6368)
In kvm_lapic_sync_from_vapic and kvm_lapic_sync_to_vapic there is the
potential to corrupt kernel memory if userspace provides an address that
is at the end of a page. This patches concerts those functions to use
kvm_write_guest_cached and kvm_read_guest_cached. It also checks the
vapic_address specified by userspace during ioctl processing and returns
an error to userspace if the address is not a valid GPA.
This is generally not guest triggerable, because the required write is
done by firmware that runs before the guest. Also, it only affects AMD
processors and oldish Intel that do not have the FlexPriority feature
(unless you disable FlexPriority, of course; then newer processors are
also affected).
Fixes: b9
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2013-6368 kernel: kvm: cross page vapic_addr access [fedora-all]
bugzilla·2013-12-12·CVSS 6.2
CVE-2013-6368 [MEDIUM] CVE-2013-6368 kernel: kvm: cross page vapic_addr access [fedora-all]
CVE-2013-6368 kernel: kvm: cross page vapic_addr access [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
Please note: this issue affects mult
Bugzilla
CVE-2013-6368 kvm: cross page vapic_addr access
bugzilla·2013-11-19·CVSS 6.2
CVE-2013-6368 [MEDIUM] CVE-2013-6368 kvm: cross page vapic_addr access
CVE-2013-6368 kvm: cross page vapic_addr access
In kvm_lapic_sync_from_vapic and kvm_lapic_sync_to_vapic there is the potential to corrupt kernel memory if userspace provides vapic_addr address that is at the end of a page.
An unprivileged local user could use this flaw to crash the system or, potentially, escalate their privileges on the system.
Acknowledgements:
Red Hat would like to thank Andrew Honig of Google for reporting this issue
Discussion:
Statement:
This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise MRG 2 as they did not provide support for the KVM subsystem.
---
This issue has been addressed in following products:
Red Hat Enterprise Linux 6
Via RHSA-2013:1801 https://rhn.redhat.com/errata/RHSA-2013-1801.html
---
Created kerne
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=fda4e2e85589191b123d31cdc21fd33ee70f50fdhttp://lists.opensuse.org/opensuse-security-announce/2014-02/msg00002.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-02/msg00003.htmlhttp://lists.opensuse.org/opensuse-updates/2014-02/msg00045.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1801.htmlhttp://rhn.redhat.com/errata/RHSA-2014-0163.htmlhttp://rhn.redhat.com/errata/RHSA-2014-0284.htmlhttp://www.openwall.com/lists/oss-security/2013/12/12/12http://www.securityfocus.com/bid/64291http://www.ubuntu.com/usn/USN-2113-1http://www.ubuntu.com/usn/USN-2117-1http://www.ubuntu.com/usn/USN-2133-1http://www.ubuntu.com/usn/USN-2134-1http://www.ubuntu.com/usn/USN-2135-1http://www.ubuntu.com/usn/USN-2136-1http://www.ubuntu.com/usn/USN-2138-1http://www.ubuntu.com/usn/USN-2139-1http://www.ubuntu.com/usn/USN-2141-1https://bugzilla.redhat.com/show_bug.cgi?id=1032210https://github.com/torvalds/linux/commit/fda4e2e85589191b123d31cdc21fd33ee70f50fdhttp://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=fda4e2e85589191b123d31cdc21fd33ee70f50fdhttp://lists.opensuse.org/opensuse-security-announce/2014-02/msg00002.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-02/msg00003.htmlhttp://lists.opensuse.org/opensuse-updates/2014-02/msg00045.htmlhttp://rhn.redhat.com/errata/RHSA-2013-1801.htmlhttp://rhn.redhat.com/errata/RHSA-2014-0163.htmlhttp://rhn.redhat.com/errata/RHSA-2014-0284.htmlhttp://www.openwall.com/lists/oss-security/2013/12/12/12http://www.securityfocus.com/bid/64291http://www.ubuntu.com/usn/USN-2113-1http://www.ubuntu.com/usn/USN-2117-1http://www.ubuntu.com/usn/USN-2133-1http://www.ubuntu.com/usn/USN-2134-1http://www.ubuntu.com/usn/USN-2135-1http://www.ubuntu.com/usn/USN-2136-1http://www.ubuntu.com/usn/USN-2138-1http://www.ubuntu.com/usn/USN-2139-1http://www.ubuntu.com/usn/USN-2141-1https://bugzilla.redhat.com/show_bug.cgi?id=1032210https://github.com/torvalds/linux/commit/fda4e2e85589191b123d31cdc21fd33ee70f50fd
2013-12-14
Published