CVE-2014-0155
published 2014-04-14CVE-2014-0155: The ioapic_deliver function in virt/kvm/ioapic.c in the Linux kernel through 3.14.1 does not properly validate the kvm_irq_delivery_to_apic return value, which…
PriorityP422medium5.5CVSS 2.0
AVAACLAuSCNINAC
EPSS
0.98%
58.9th percentile
The ioapic_deliver function in virt/kvm/ioapic.c in the Linux kernel through 3.14.1 does not properly validate the kvm_irq_delivery_to_apic return value, which allows guest OS users to cause a denial of service (host OS crash) via a crafted entry in the redirection table of an I/O APIC. NOTE: the affected code was moved to the ioapic_service function before the vulnerability was announced.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 3.14.4-1 (bookworm) | linux 3.14.4-1 (bookworm) |
| linux | linux_kernel | < 3.14.1 | 3.14.1 |
| linux | linux_kernel | >= 0 < 3.14.4-1 | 3.14.4-1 |
| linux | linux_kernel | >= 0 < 3.14.4-1 | 3.14.4-1 |
| linux | linux_kernel | >= 0 < 3.14.4-1 | 3.14.4-1 |
| linux | linux_kernel | >= 0 < 3.14.4-1 | 3.14.4-1 |
| linux | linux_kernel | >= 0 < 3.13.0-35.62 | 3.13.0-35.62 |
CVSS provenance
nvdv2.05.5MEDIUMAV:A/AC:L/Au:S/C:N/I:N/A:C
osv5.5MEDIUM
vendor_debian5.5LOW
vendor_redhat5.5MEDIUM
vendor_ubuntu5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-qr89-7v4c-gj8q: The ioapic_deliver function in virt/kvm/ioapic
ghsa_unreviewed·2022-05-13
CVE-2014-0155 [MEDIUM] CWE-20 GHSA-qr89-7v4c-gj8q: The ioapic_deliver function in virt/kvm/ioapic
The ioapic_deliver function in virt/kvm/ioapic.c in the Linux kernel through 3.14.1 does not properly validate the kvm_irq_delivery_to_apic return value, which allows guest OS users to cause a denial of service (host OS crash) via a crafted entry in the redirection table of an I/O APIC. NOTE: the affected code was moved to the ioapic_service function before the vulnerability was announced.
OSV
linux vulnerabilities
osv·2014-09-02·CVSS 5.5
CVE-2014-0155 [MEDIUM] linux vulnerabilities
linux vulnerabilities
A flaw was discovered in the Linux kernel virtual machine's (kvm)
validation of interrupt requests (irq). A guest OS user could exploit this
flaw to cause a denial of service (host OS crash). (CVE-2014-0155)
Andy Lutomirski discovered a flaw in the authorization of netlink socket
operations when a socket is passed to a process of more privilege. A local
user could exploit this flaw to bypass access restrictions by having a
privileged executable do something it was not intended to do.
(CVE-2014-0181)
An information leak was discovered in the Linux kernels
aio_read_events_ring function. A local user could exploit this flaw to
obtain potentially sensitive information from kernel memory.
(CVE-2014-0206)
A flaw was discovered in the Linux kernel's implementation of use
OSV
CVE-2014-0155: The ioapic_deliver function in virt/kvm/ioapic
osv·2014-04-14·CVSS 5.5
CVE-2014-0155 [MEDIUM] CVE-2014-0155: The ioapic_deliver function in virt/kvm/ioapic
The ioapic_deliver function in virt/kvm/ioapic.c in the Linux kernel through 3.14.1 does not properly validate the kvm_irq_delivery_to_apic return value, which allows guest OS users to cause a denial of service (host OS crash) via a crafted entry in the redirection table of an I/O APIC. NOTE: the affected code was moved to the ioapic_service function before the vulnerability was announced.
Kernel
Merge git://git.kernel.org/pub/scm/virt/kvm/kvm
kernel_security·2014-04-14·CVSS 5.5
CVE-2014-0155 [MEDIUM] Merge git://git.kernel.org/pub/scm/virt/kvm/kvm
Merge git://git.kernel.org/pub/scm/virt/kvm/kvm
Pull KVM fixes from Marcelo Tosatti:
- Fix for guest triggerable BUG_ON (CVE-2014-0155)
- CR4.SMAP support
- Spurious WARN_ON() fix
* git://git.kernel.org/pub/scm/virt/kvm/kvm:
KVM: x86: remove WARN_ON from get_kernel_ns()
KVM: Rename variable smep to cr4_smep
KVM: expose SMAP feature to guest
KVM: Disable SMAP for guests in EPT realmode and EPT unpaging mode
KVM: Add SMAP support when setting CR4
KVM: Remove SMAP bit from CR4_RESERVED_BITS
KVM: ioapic: try to recover if pending_eoi goes out of range
KVM: ioapic: fix assignment of ioapic->rtc_status.pending_eoi (CVE-2014-0155)
Kernel
KVM: ioapic: fix assignment of ioapic->rtc_status.pending_eoi (CVE-2014-0155)
kernel_security·2014-03-28·CVSS 5.5
CVE-2014-0155 [MEDIUM] KVM: ioapic: fix assignment of ioapic->rtc_status.pending_eoi (CVE-2014-0155)
KVM: ioapic: fix assignment of ioapic->rtc_status.pending_eoi (CVE-2014-0155)
QE reported that they got the BUG_ON in ioapic_service to trigger.
I cannot reproduce it, but there are two reasons why this could happen.
The less likely but also easiest one, is when kvm_irq_delivery_to_apic
does not deliver to any APIC and returns -1.
Because irqe.shorthand == 0, the kvm_for_each_vcpu loop in that
function is never reached. However, you can target the similar loop in
kvm_irq_delivery_to_apic_fast; just program a zero logical destination
address into the IOAPIC, or an out-of-range physical destination address.
Signed-off-by: Paolo Bonzini
Ubuntu
Linux kernel (Trusty HWE) vulnerabilities
vendor_ubuntu·2014-09-02·CVSS 5.5
CVE-2014-0155 [MEDIUM] Linux kernel (Trusty HWE) vulnerabilities
Title: Linux kernel (Trusty HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
A flaw was discovered in the Linux kernel virtual machine's (kvm)
validation of interrupt requests (irq). A guest OS user could exploit this
flaw to cause a denial of service (host OS crash). (CVE-2014-0155)
Andy Lutomirski discovered a flaw in the authorization of netlink socket
operations when a socket is passed to a process of more privilege. A local
user could exploit this flaw to bypass access restrictions by having a
privileged executable do something it was not intended to do.
(CVE-2014-0181)
An information leak was discovered in the Linux kernels
aio_read_events_ring function. A local user could exploit this flaw to
obtain potentially sensitive information from kernel mem
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2014-09-02·CVSS 5.5
CVE-2014-0155 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
A flaw was discovered in the Linux kernel virtual machine's (kvm)
validation of interrupt requests (irq). A guest OS user could exploit this
flaw to cause a denial of service (host OS crash). (CVE-2014-0155)
Andy Lutomirski discovered a flaw in the authorization of netlink socket
operations when a socket is passed to a process of more privilege. A local
user could exploit this flaw to bypass access restrictions by having a
privileged executable do something it was not intended to do.
(CVE-2014-0181)
An information leak was discovered in the Linux kernels
aio_read_events_ring function. A local user could exploit this flaw to
obtain potentially sensitive information from kernel memory.
(CVE-201
Ubuntu
Linux kernel (Saucy HWE) vulnerabilities
vendor_ubuntu·2014-06-05·CVSS 5.5
CVE-2014-0155 [MEDIUM] Linux kernel (Saucy HWE) vulnerabilities
Title: Linux kernel (Saucy HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Pinkie Pie discovered a flaw in the Linux kernel's futex subsystem. An
unprivileged local user could exploit this flaw to cause a denial of
service (system crash) or gain administrative privileges. (CVE-2014-3153)
A flaw was discovered in the Linux kernel virtual machine's (kvm)
validation of interrupt requests (irq). A guest OS user could exploit this
flaw to cause a denial of service (host OS crash). (CVE-2014-0155)
An information leak was discovered in the netfilter subsystem of the Linux
kernel. An attacker could exploit this flaw to obtain sensitive information
from kernel memory. (CVE-2014-2568)
Sasha Levin reported a bug in the Linux kernel's virtual memory management
subs
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2014-06-05·CVSS 5.5
CVE-2014-0155 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
Pinkie Pie discovered a flaw in the Linux kernel's futex subsystem. An
unprivileged local user could exploit this flaw to cause a denial of
service (system crash) or gain administrative privileges. (CVE-2014-3153)
A flaw was discovered in the Linux kernel virtual machine's (kvm)
validation of interrupt requests (irq). A guest OS user could exploit this
flaw to cause a denial of service (host OS crash). (CVE-2014-0155)
An information leak was discovered in the netfilter subsystem of the Linux
kernel. An attacker could exploit this flaw to obtain sensitive information
from kernel memory. (CVE-2014-2568)
Sasha Levin reported a bug in the Linux kernel's virtual memory management
subsystem. An un
Red Hat
kernel: kvm: BUG caused by invalid entry in guest ioapic redirection table
vendor_redhat·2014-04-04·CVSS 5.5
CVE-2014-0155 [MEDIUM] kernel: kvm: BUG caused by invalid entry in guest ioapic redirection table
kernel: kvm: BUG caused by invalid entry in guest ioapic redirection table
The ioapic_deliver function in virt/kvm/ioapic.c in the Linux kernel through 3.14.1 does not properly validate the kvm_irq_delivery_to_apic return value, which allows guest OS users to cause a denial of service (host OS crash) via a crafted entry in the redirection table of an I/O APIC. NOTE: the affected code was moved to the ioapic_service function before the vulnerability was announced.
Statement: Not vulnerable.
This issue did not affect the versions of kvm package as shipped with Red Hat Enterprise Linux 5.
This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 6.
This issue did not affect the versions of Linux kernel as shipped with Red Hat
Enterprise Linux 5 and
Debian
CVE-2014-0155: linux - The ioapic_deliver function in virt/kvm/ioapic.c in the Linux kernel through 3.1...
vendor_debian·2014·CVSS 5.5
CVE-2014-0155 [MEDIUM] CVE-2014-0155: linux - The ioapic_deliver function in virt/kvm/ioapic.c in the Linux kernel through 3.1...
The ioapic_deliver function in virt/kvm/ioapic.c in the Linux kernel through 3.14.1 does not properly validate the kvm_irq_delivery_to_apic return value, which allows guest OS users to cause a denial of service (host OS crash) via a crafted entry in the redirection table of an I/O APIC. NOTE: the affected code was moved to the ioapic_service function before the vulnerability was announced.
Scope: local
bookworm: resolved (fixed in 3.14.4-1)
bullseye: resolved (fixed in 3.14.4-1)
forky: resolved (fixed in 3.14.4-1)
sid: resolved (fixed in 3.14.4-1)
trixie: resolved (fixed in 3.14.4-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2014-0155 kernel: kvm: BUG caused by invalid entry in guest ioapic redirection table [fedora-all]
bugzilla·2014-04-07·CVSS 5.5
CVE-2014-0155 [MEDIUM] CVE-2014-0155 kernel: kvm: BUG caused by invalid entry in guest ioapic redirection table [fedora-all]
CVE-2014-0155 kernel: kvm: BUG caused by invalid entry in guest ioapic redirection table [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
Ple
Bugzilla
CVE-2014-0155 kernel: kvm: BUG caused by invalid entry in guest ioapic redirection table
bugzilla·2014-03-27·CVSS 5.5
CVE-2014-0155 [MEDIUM] CVE-2014-0155 kernel: kvm: BUG caused by invalid entry in guest ioapic redirection table
CVE-2014-0155 kernel: kvm: BUG caused by invalid entry in guest ioapic redirection table
It was found that invalid entries in guest ioapic redirection table could lead to BUG_ON in ioapic_deliver() function.
A privileged user in the guest could use this flaw to crash the host.
Acknowledgements:
This issue was discovered by Red Hat.
Discussion:
Statement:
Not vulnerable.
This issue did not affect the versions of kvm package as shipped with Red Hat Enterprise Linux 5.
This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 6.
This issue did not affect the versions of Linux kernel as shipped with Red Hat
Enterprise Linux 5 and Red Hat Enterprise MRG 2 as they did not provide support
for the KVM subsystem.
---
Created kernel tracking bugs
http://git.kernel.org/cgit/virt/kvm/kvm.git/commit/?id=5678de3f15010b9022ee45673f33bcfc71d47b60http://www.openwall.com/lists/oss-security/2014/04/07/2https://bugzilla.redhat.com/show_bug.cgi?id=1081589http://git.kernel.org/cgit/virt/kvm/kvm.git/commit/?id=5678de3f15010b9022ee45673f33bcfc71d47b60http://www.openwall.com/lists/oss-security/2014/04/07/2https://bugzilla.redhat.com/show_bug.cgi?id=1081589
2014-04-14
Published