CVE-2013-6376
published 2013-12-14CVE-2013-6376: The recalculate_apic_map function in arch/x86/kvm/lapic.c in the KVM subsystem in the Linux kernel through 3.12.5 allows guest OS users to cause a denial of…
PriorityP420medium5.2CVSS 2.0
AVAACMAuSCNINAC
EPSS
1.10%
62.5th percentile
The recalculate_apic_map function in arch/x86/kvm/lapic.c in the KVM subsystem in the Linux kernel through 3.12.5 allows guest OS users to cause a denial of service (host OS crash) via a crafted ICR write operation in x2apic mode.
Affected
247 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 3.12.5-1 (bookworm) | linux 3.12.5-1 (bookworm) |
| linux | linux_kernel | <= 3.12.5 | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
CVSS provenance
nvdv2.05.2MEDIUMAV:A/AC:M/Au:S/C:N/I:N/A:C
osv5.2MEDIUM
vendor_ubuntu7.1HIGH
vendor_debian5.2MEDIUM
vendor_redhat5.2MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-qf53-fv6c-77m8: The recalculate_apic_map function in arch/x86/kvm/lapic
ghsa_unreviewed·2022-05-17
CVE-2013-6376 [MEDIUM] GHSA-qf53-fv6c-77m8: The recalculate_apic_map function in arch/x86/kvm/lapic
The recalculate_apic_map function in arch/x86/kvm/lapic.c in the KVM subsystem in the Linux kernel through 3.12.5 allows guest OS users to cause a denial of service (host OS crash) via a crafted ICR write operation in x2apic mode.
Kernel
KVM: x86: allow 256 logical x2APICs again
kernel_security·2014-11-27·CVSS 5.2
CVE-2013-6376 [MEDIUM] KVM: x86: allow 256 logical x2APICs again
KVM: x86: allow 256 logical x2APICs again
While fixing an x2apic bug,
17d68b7 KVM: x86: fix guest-initiated crash with x2apic (CVE-2013-6376)
we've made only one cluster available. This means that the amount of
logically addressible x2APICs was reduced to 16 and VCPUs kept
overwriting themselves in that region, so even the first cluster wasn't
set up correctly.
This patch extends x2APIC support back to the logical_map's limit, and
keeps the CVE fixed as messages for non-present APICs are dropped.
Signed-off-by: Radim Krčmář
Signed-off-by: Paolo Bonzini
OSV
CVE-2013-6376: The recalculate_apic_map function in arch/x86/kvm/lapic
osv·2013-12-14·CVSS 5.2
CVE-2013-6376 [MEDIUM] CVE-2013-6376: The recalculate_apic_map function in arch/x86/kvm/lapic
The recalculate_apic_map function in arch/x86/kvm/lapic.c in the KVM subsystem in the Linux kernel through 3.12.5 allows guest OS users to cause a denial of service (host OS crash) via a crafted ICR write operation in x2apic mode.
Kernel
KVM: x86: fix guest-initiated crash with x2apic (CVE-2013-6376)
kernel_security·2013-12-12·CVSS 5.2
CVE-2013-6376 [MEDIUM] KVM: x86: fix guest-initiated crash with x2apic (CVE-2013-6376)
KVM: x86: fix guest-initiated crash with x2apic (CVE-2013-6376)
A guest can cause a BUG_ON() leading to a host kernel crash.
When the guest writes to the ICR to request an IPI, while in x2apic
mode the following things happen, the destination is read from
ICR2, which is a register that the guest can control.
kvm_irq_delivery_to_apic_fast uses the high 16 bits of ICR2 as the
cluster id. A BUG_ON is triggered, which is a protection against
accessing map->logical_map with an out-of-bounds access and manages
to avoid that anything really unsafe occurs.
The logic in the code is correct from real HW point of view. The problem
is that KVM supports only one cluster with ID 0 in clustered mode, but
the code that has the bug does not take this into account.
Reported-by: Lars Bull
Cc: stable@vger
Kernel
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm
kernel_security·2013-12-12·CVSS 7.2
CVE-2013-4587 [HIGH] Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm
Pull kvm fixes from Paolo Bonzini:
"Four security fixes for KVM on x86. Thanks to Andrew Honig and Lars
Bull from Google for reporting them"
* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
KVM: x86: fix guest-initiated crash with x2apic (CVE-2013-6376)
KVM: x86: Convert vapic synchronization to _cached functions (CVE-2013-6368)
KVM: x86: Fix potential divide by 0 in lapic (CVE-2013-6367)
KVM: Improve create VCPU parameter (CVE-2013-4587)
Ubuntu
Linux kernel (Raring HWE) vulnerabilities
vendor_ubuntu·2014-03-07·CVSS 4.3
CVE-2013-4579 [MEDIUM] Linux kernel (Raring HWE) vulnerabilities
Title: Linux kernel (Raring HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Mathy Vanhoef discovered an error in the the way the ath9k driver was
handling the BSSID masking. A remote attacker could exploit this error to
discover the original MAC address after a spoofing atack. (CVE-2013-4579)
Andrew Honig reported a flaw in the Linux Kernel's kvm_vm_ioctl_create_vcpu
function of the Kernel Virtual Machine (KVM) subsystem. A local user could
exploit this flaw to gain privileges on the host machine. (CVE-2013-4587)
Andrew Honig reported a flaw in the apic_get_tmcct function of the Kernel
Virtual Machine (KVM) subsystem if the Linux kernel. A guest OS user could
exploit this flaw to cause a denial of service or host OS system crash.
(CVE-2013-6367)
Andrew
Ubuntu
Linux kernel (Saucy HWE) vulnerabilities
vendor_ubuntu·2014-02-18·CVSS 7.1
CVE-2013-4563 [HIGH] Linux kernel (Saucy HWE) vulnerabilities
Title: Linux kernel (Saucy HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Saran Neti reported a flaw in the ipv6 UDP Fragmentation Offload (UFI) in
the Linux kernel. A remote attacker could exploit this flaw to cause a
denial of service (panic). (CVE-2013-4563)
Mathy Vanhoef discovered an error in the the way the ath9k driver was
handling the BSSID masking. A remote attacker could exploit this error to
discover the original MAC address after a spoofing atack. (CVE-2013-4579)
Andrew Honig reported a flaw in the Linux Kernel's kvm_vm_ioctl_create_vcpu
function of the Kernel Virtual Machine (KVM) subsystem. A local user could
exploit this flaw to gain privileges on the host machine. (CVE-2013-4587)
Andrew Honig reported a flaw in the apic_get_tmcct functi
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2014-02-18·CVSS 7.1
CVE-2013-4563 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
Saran Neti reported a flaw in the ipv6 UDP Fragmentation Offload (UFI) in
the Linux kernel. A remote attacker could exploit this flaw to cause a
denial of service (panic). (CVE-2013-4563)
Mathy Vanhoef discovered an error in the the way the ath9k driver was
handling the BSSID masking. A remote attacker could exploit this error to
discover the original MAC address after a spoofing atack. (CVE-2013-4579)
Andrew Honig reported a flaw in the Linux Kernel's kvm_vm_ioctl_create_vcpu
function of the Kernel Virtual Machine (KVM) subsystem. A local user could
exploit this flaw to gain privileges on the host machine. (CVE-2013-4587)
Andrew Honig reported a flaw in the apic_get_tmcct function of the Ke
Red Hat
kernel: kvm: BUG_ON() in apic_cluster_id()
vendor_redhat·2013-12-12·CVSS 5.2
CVE-2013-6376 [MEDIUM] kernel: kvm: BUG_ON() in apic_cluster_id()
kernel: kvm: BUG_ON() in apic_cluster_id()
The recalculate_apic_map function in arch/x86/kvm/lapic.c in the KVM subsystem in the Linux kernel through 3.12.5 allows guest OS users to cause a denial of service (host OS crash) via a crafted ICR write operation in x2apic mode.
Statement: Not vulnerable.
This issue did not affect the versions of kvm packages as shipped with Red Hat Enterprise Linux 5. This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise 6.
This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise MRG 2 as they did not provide support for the KVM subsystem.
Package: kernel (Red Hat Enterprise Linux 5) - Not affected
Package: kvm (Red Hat Enterprise Linux 5) - Not affected
Package: kernel (Red Hat Enterpris
Debian
CVE-2013-6376: linux - The recalculate_apic_map function in arch/x86/kvm/lapic.c in the KVM subsystem i...
vendor_debian·2013·CVSS 5.2
CVE-2013-6376 [MEDIUM] CVE-2013-6376: linux - The recalculate_apic_map function in arch/x86/kvm/lapic.c in the KVM subsystem i...
The recalculate_apic_map function in arch/x86/kvm/lapic.c in the KVM subsystem in the Linux kernel through 3.12.5 allows guest OS users to cause a denial of service (host OS crash) via a crafted ICR write operation in x2apic mode.
Scope: local
bookworm: resolved (fixed in 3.12.5-1)
bullseye: resolved (fixed in 3.12.5-1)
forky: resolved (fixed in 3.12.5-1)
sid: resolved (fixed in 3.12.5-1)
trixie: resolved (fixed in 3.12.5-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2013-6376 kernel: kvm: BUG_ON() in apic_cluster_id() [fedora-all]
bugzilla·2013-12-12·CVSS 5.2
CVE-2013-6376 [MEDIUM] CVE-2013-6376 kernel: kvm: BUG_ON() in apic_cluster_id() [fedora-all]
CVE-2013-6376 kernel: kvm: BUG_ON() in apic_cluster_id() [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
Please note: this issue affects mul
Bugzilla
CVE-2013-6376 kernel: kvm: BUG_ON() in apic_cluster_id()
bugzilla·2013-11-21·CVSS 5.2
CVE-2013-6376 [MEDIUM] CVE-2013-6376 kernel: kvm: BUG_ON() in apic_cluster_id()
CVE-2013-6376 kernel: kvm: BUG_ON() in apic_cluster_id()
Privileged guest user could trigger BUG_ON() in apic_cluster_id() when writing certain values to ICR register to request an IPI, while in x2apic mode.
A privileged guest user could use this flaw to crash the host.
Acknowledgements:
Red Hat would like to thank Lars Bull of Google for reporting this issue.
Discussion:
Statement:
Not vulnerable.
This issue did not affect the versions of kvm packages as shipped with Red Hat Enterprise Linux 5. This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise 6.
This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise MRG 2 as they did not provide support for the KVM subsystem.
---
Created kernel tracking bugs for this is
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=17d68b763f09a9ce824ae23eb62c9efc57b69271http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00002.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-02/msg00003.htmlhttp://www.openwall.com/lists/oss-security/2013/12/12/12http://www.securityfocus.com/bid/64319http://www.ubuntu.com/usn/USN-2113-1http://www.ubuntu.com/usn/USN-2117-1http://www.ubuntu.com/usn/USN-2136-1https://bugzilla.redhat.com/show_bug.cgi?id=1033106https://github.com/torvalds/linux/commit/17d68b763f09a9ce824ae23eb62c9efc57b69271http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=17d68b763f09a9ce824ae23eb62c9efc57b69271http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00002.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-02/msg00003.htmlhttp://www.openwall.com/lists/oss-security/2013/12/12/12http://www.securityfocus.com/bid/64319http://www.ubuntu.com/usn/USN-2113-1http://www.ubuntu.com/usn/USN-2117-1http://www.ubuntu.com/usn/USN-2136-1https://bugzilla.redhat.com/show_bug.cgi?id=1033106https://github.com/torvalds/linux/commit/17d68b763f09a9ce824ae23eb62c9efc57b69271
2013-12-14
Published