CVE-2014-0049
published 2014-03-11CVE-2014-0049: Buffer overflow in the complete_emulated_mmio function in arch/x86/kvm/x86.c in the Linux kernel before 3.13.6 allows guest OS users to execute arbitrary code…
PriorityP335high7.4CVSS 2.0
AVAACMAuSCCICAC
EPSS
0.78%
52.2th percentile
Buffer overflow in the complete_emulated_mmio function in arch/x86/kvm/x86.c in the Linux kernel before 3.13.6 allows guest OS users to execute arbitrary code on the host OS by leveraging a loop that triggers an invalid memory copy affecting certain cancel_work_item data.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 3.13.6-1 (bookworm) | linux 3.13.6-1 (bookworm) |
| linux | linux_kernel | < 3.13.6 | 3.13.6 |
| linux | linux_kernel | >= 0 < 3.13.6-1 | 3.13.6-1 |
| linux | linux_kernel | >= 0 < 3.13.6-1 | 3.13.6-1 |
| linux | linux_kernel | >= 0 < 3.13.6-1 | 3.13.6-1 |
| linux | linux_kernel | >= 0 < 3.13.6-1 | 3.13.6-1 |
CVSS provenance
nvdv2.07.4HIGHAV:A/AC:M/Au:S/C:C/I:C/A:C
osv7.4HIGH
vendor_debian7.4HIGH
vendor_redhat7.4HIGH
vendor_ubuntu7.4HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-vm7h-784c-gg5h: Buffer overflow in the complete_emulated_mmio function in arch/x86/kvm/x86
ghsa_unreviewed·2022-05-13
CVE-2014-0049 [HIGH] CWE-120 GHSA-vm7h-784c-gg5h: Buffer overflow in the complete_emulated_mmio function in arch/x86/kvm/x86
Buffer overflow in the complete_emulated_mmio function in arch/x86/kvm/x86.c in the Linux kernel before 3.13.6 allows guest OS users to execute arbitrary code on the host OS by leveraging a loop that triggers an invalid memory copy affecting certain cancel_work_item data.
OSV
CVE-2014-0049: Buffer overflow in the complete_emulated_mmio function in arch/x86/kvm/x86
osv·2014-03-11·CVSS 7.4
CVE-2014-0049 [HIGH] CVE-2014-0049: Buffer overflow in the complete_emulated_mmio function in arch/x86/kvm/x86
Buffer overflow in the complete_emulated_mmio function in arch/x86/kvm/x86.c in the Linux kernel before 3.13.6 allows guest OS users to execute arbitrary code on the host OS by leveraging a loop that triggers an invalid memory copy affecting certain cancel_work_item data.
Kernel
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm
kernel_security·2014-02-28·CVSS 7.4
CVE-2014-0049 [HIGH] Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm
Pull KVM fixes from Paolo Bonzini:
"Three x86 fixes and one for ARM/ARM64.
In particular, nested virtualization on Intel is broken in 3.13 and
fixed by this pull request"
* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
kvm, vmx: Really fix lazy FPU on nested guest
kvm: x86: fix emulator buffer overflow (CVE-2014-0049)
arm/arm64: KVM: detect CPU reset on CPU_PM_EXIT
KVM: MMU: drop read-only large sptes when creating lower level sptes
Kernel
kvm: x86: fix emulator buffer overflow (CVE-2014-0049)
kernel_security·2014-02-27·CVSS 7.4
CVE-2014-0049 [HIGH] kvm: x86: fix emulator buffer overflow (CVE-2014-0049)
kvm: x86: fix emulator buffer overflow (CVE-2014-0049)
The problem occurs when the guest performs a pusha with the stack
address pointing to an mmio address (or an invalid guest physical
address) to start with, but then extending into an ordinary guest
physical address. When doing repeated emulated pushes
emulator_read_write sets mmio_needed to 1 on the first one. On a
later push when the stack points to regular memory,
mmio_nr_fragments is set to 0, but mmio_is_needed is not set to 0.
As a result, KVM exits to userspace, and then returns to
complete_emulated_mmio. In complete_emulated_mmio
vcpu->mmio_cur_fragment is incremented. The termination condition of
vcpu->mmio_cur_fragment == vcpu->mmio_nr_fragments is never achieved.
The code bounces back and fourth to userspace incrementing
mm
Ubuntu
Linux kernel (Raring HWE) vulnerabilities
vendor_ubuntu·2014-04-26·CVSS 7.4
CVE-2014-0049 [HIGH] Linux kernel (Raring HWE) vulnerabilities
Title: Linux kernel (Raring HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
A flaw was discovered in the Kernel Virtual Machine (KVM) subsystem of the
Linux kernel. A guest OS user could exploit this flaw to execute arbitrary
code on the host OS. (CVE-2014-0049)
Al Viro discovered an error in how CIFS in the Linux kernel handles
uncached write operations. An unprivileged local user could exploit this
flaw to cause a denial of service (system crash), obtain sensitive
information from kernel memory, or possibly gain privileges.
(CVE-2014-0069)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, w
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2014-04-26·CVSS 7.4
CVE-2014-0049 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
A flaw was discovered in the Kernel Virtual Machine (KVM) subsystem of the
Linux kernel. A guest OS user could exploit this flaw to execute arbitrary
code on the host OS. (CVE-2014-0049)
Al Viro discovered an error in how CIFS in the Linux kernel handles
uncached write operations. An unprivileged local user could exploit this
flaw to cause a denial of service (system crash), obtain sensitive
information from kernel memory, or possibly gain privileges.
(CVE-2014-0069)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires
Ubuntu
Linux kernel (Quantal HWE) vulnerabilities
vendor_ubuntu·2014-04-26·CVSS 7.4
CVE-2014-0049 [HIGH] Linux kernel (Quantal HWE) vulnerabilities
Title: Linux kernel (Quantal HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
A flaw was discovered in the Kernel Virtual Machine (KVM) subsystem of the
Linux kernel. A guest OS user could exploit this flaw to execute arbitrary
code on the host OS. (CVE-2014-0049)
Al Viro discovered an error in how CIFS in the Linux kernel handles
uncached write operations. An unprivileged local user could exploit this
flaw to cause a denial of service (system crash), obtain sensitive
information from kernel memory, or possibly gain privileges.
(CVE-2014-0069)
Jouni Malinen reported a flaw in the handling of fragmentation in the
mac8Linux subsystem of the kernel. A remote attacker could exploit this
flaw to obtain potential sensitive cleartext information by reading
packe
Ubuntu
Linux kernel (OMAP4) vulnerabilities
vendor_ubuntu·2014-04-26·CVSS 7.4
CVE-2014-0049 [HIGH] Linux kernel (OMAP4) vulnerabilities
Title: Linux kernel (OMAP4) vulnerabilities
Summary: Several security issues were fixed in the kernel.
A flaw was discovered in the Kernel Virtual Machine (KVM) subsystem of the
Linux kernel. A guest OS user could exploit this flaw to execute arbitrary
code on the host OS. (CVE-2014-0049)
Al Viro discovered an error in how CIFS in the Linux kernel handles
uncached write operations. An unprivileged local user could exploit this
flaw to cause a denial of service (system crash), obtain sensitive
information from kernel memory, or possibly gain privileges.
(CVE-2014-0069)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which
Ubuntu
Linux kernel (Saucy HWE) vulnerabilities
vendor_ubuntu·2014-04-26·CVSS 7.4
CVE-2014-0049 [HIGH] Linux kernel (Saucy HWE) vulnerabilities
Title: Linux kernel (Saucy HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
A flaw was discovered in the Kernel Virtual Machine (KVM) subsystem of the
Linux kernel. A guest OS user could exploit this flaw to execute arbitrary
code on the host OS. (CVE-2014-0049)
Al Viro discovered an error in how CIFS in the Linux kernel handles
uncached write operations. An unprivileged local user could exploit this
flaw to cause a denial of service (system crash), obtain sensitive
information from kernel memory, or possibly gain privileges.
(CVE-2014-0069)
Jouni Malinen reported a flaw in the handling of fragmentation in the
mac8Linux subsystem of the kernel. A remote attacker could exploit this
flaw to obtain potential sensitive cleartext information by reading
packets
Red Hat
kernel: kvm: mmio_fragments out-of-the-bounds access
vendor_redhat·2014-03-03·CVSS 7.4
CVE-2014-0049 [HIGH] kernel: kvm: mmio_fragments out-of-the-bounds access
kernel: kvm: mmio_fragments out-of-the-bounds access
Buffer overflow in the complete_emulated_mmio function in arch/x86/kvm/x86.c in the Linux kernel before 3.13.6 allows guest OS users to execute arbitrary code on the host OS by leveraging a loop that triggers an invalid memory copy affecting certain cancel_work_item data.
Statement: Not vulnerable.
This issue did not affect the versions of kvm package as shipped with Red
Hat Enterprise Linux 5 as they did not backport the upstream kvm commit
that introduced this issue.
This issue did not affect the versions of Linux kernel as shipped Red Hat
Enterprise Linux 6 as they did not backport the upstream kvm commit that
introduced this issue.
This issue did not affect the versions of Linux kernel as shipped Red Hat
Enterprise MRG as they did
Debian
CVE-2014-0049: linux - Buffer overflow in the complete_emulated_mmio function in arch/x86/kvm/x86.c in ...
vendor_debian·2014·CVSS 7.4
CVE-2014-0049 [HIGH] CVE-2014-0049: linux - Buffer overflow in the complete_emulated_mmio function in arch/x86/kvm/x86.c in ...
Buffer overflow in the complete_emulated_mmio function in arch/x86/kvm/x86.c in the Linux kernel before 3.13.6 allows guest OS users to execute arbitrary code on the host OS by leveraging a loop that triggers an invalid memory copy affecting certain cancel_work_item data.
Scope: local
bookworm: resolved (fixed in 3.13.6-1)
bullseye: resolved (fixed in 3.13.6-1)
forky: resolved (fixed in 3.13.6-1)
sid: resolved (fixed in 3.13.6-1)
trixie: resolved (fixed in 3.13.6-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2014-0049 kernel: kvm: mmio_fragments out-of-the-bounds access [fedora-all]
bugzilla·2014-03-03·CVSS 7.4
CVE-2014-0049 [HIGH] CVE-2014-0049 kernel: kvm: mmio_fragments out-of-the-bounds access [fedora-all]
CVE-2014-0049 kernel: kvm: mmio_fragments out-of-the-bounds access [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
Please note: this issue a
Bugzilla
CVE-2014-0049 kernel: kvm: mmio_fragments out-of-the-bounds access
bugzilla·2014-02-06·CVSS 7.4
CVE-2014-0049 [HIGH] CVE-2014-0049 kernel: kvm: mmio_fragments out-of-the-bounds access
CVE-2014-0049 kernel: kvm: mmio_fragments out-of-the-bounds access
The problem occurs when the guest performs a pusha with the stack address
pointing to an mmio address (or an invalid guest physical address) to
start with, but then extending into an ordinary guest physical address.
When doing repeated emulated pushes emulator_read_write sets mmio_needed
to 1 on the first one. On a later push when the stack points to regular
memory, mmio_nr_fragments is set to 0, but mmio_is_needed is not set
to 0.
As a result, KVM exits to userspace, and then returns to
complete_emulated_mmio. In complete_emulated_mmio
vcpu->mmio_cur_fragment is incremented. The termination condition of
vcpu->mmio_cur_fragment == vcpu->mmio_nr_fragments is never achieved.
The code bounces back and fourth to userspace inc
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a08d3b3b99efd509133946056531cdf8f3a0c09bhttp://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.6http://www.openwall.com/lists/oss-security/2014/03/03/1https://bugzilla.redhat.com/show_bug.cgi?id=1062368https://github.com/torvalds/linux/commit/a08d3b3b99efd509133946056531cdf8f3a0c09bhttp://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=a08d3b3b99efd509133946056531cdf8f3a0c09bhttp://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.6http://www.openwall.com/lists/oss-security/2014/03/03/1https://bugzilla.redhat.com/show_bug.cgi?id=1062368https://github.com/torvalds/linux/commit/a08d3b3b99efd509133946056531cdf8f3a0c09b
2014-03-11
Published