CVE-2014-3690
published 2014-11-10CVE-2014-3690: arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.17.2 on Intel processors does not ensure that the value in the CR4 control register…
PriorityP425medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.52%
40.7th percentile
arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.17.2 on Intel processors does not ensure that the value in the CR4 control register remains the same after a VM entry, which allows host OS users to kill arbitrary processes or cause a denial of service (system disruption) by leveraging /dev/kvm access, as demonstrated by PR_SET_TSC prctl calls within a modified copy of QEMU.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | linux | < linux 3.16.7-1 (bookworm) | linux 3.16.7-1 (bookworm) |
| linux | linux_kernel | < 3.17.2 | 3.17.2 |
| linux | linux_kernel | >= 0 < 3.16.7-1 | 3.16.7-1 |
| linux | linux_kernel | >= 0 < 3.16.7-1 | 3.16.7-1 |
| linux | linux_kernel | >= 0 < 3.16.7-1 | 3.16.7-1 |
| linux | linux_kernel | >= 0 < 3.16.7-1 | 3.16.7-1 |
| linux | linux_kernel | >= 0 < 3.13.0-40.69 | 3.13.0-40.69 |
| novell | suse_linux_enterprise_desktop | — | — |
| novell | suse_linux_enterprise_server | — | — |
| novell | suse_linux_enterprise_server | — | — |
| opensuse | evergreen | — | — |
| redhat | enterprise_linux | — | — |
| suse | linux_enterprise_real_time_extension | — | — |
| suse | linux_enterprise_software_development_kit | — | — |
| suse | linux_enterprise_workstation_extension | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvdv2.04.9MEDIUMAV:L/AC:L/Au:N/C:N/I:N/A:C
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
vendor_ubuntu5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-647r-22pp-rpp3: arch/x86/kvm/vmx
ghsa_unreviewed·2022-05-13
CVE-2014-3690 [MEDIUM] CWE-400 GHSA-647r-22pp-rpp3: arch/x86/kvm/vmx
arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.17.2 on Intel processors does not ensure that the value in the CR4 control register remains the same after a VM entry, which allows host OS users to kill arbitrary processes or cause a denial of service (system disruption) by leveraging /dev/kvm access, as demonstrated by PR_SET_TSC prctl calls within a modified copy of QEMU.
OSV
linux vulnerabilities
osv·2014-11-25·CVSS 5.5
CVE-2014-3690 [MEDIUM] linux vulnerabilities
linux vulnerabilities
A flaw was discovered in how the Linux kernel's KVM (Kernel Virtual
Machine) subsystem handles the CR4 control register at VM entry on Intel
processors. A local host OS user can exploit this to cause a denial of
service (kill arbitrary processes, or system disruption) by leveraging
/dev/kvm access. (CVE-2014-3690)
Don Bailey discovered a flaw in the LZO decompress algorithm used by the
Linux kernel. An attacker could exploit this flaw to cause a denial of
service (memory corruption or OOPS). (CVE-2014-4608)
Andy Lutomirski discovered a flaw in how the Linux kernel handles
pivot_root when used with a chroot directory. A local user could exploit
this flaw to cause a denial of service (mount-tree loop). (CVE-2014-7970)
Andy Lutomirski discovered that the Linux kernel
OSV
CVE-2014-3690: arch/x86/kvm/vmx
osv·2014-11-10·CVSS 5.5
CVE-2014-3690 [MEDIUM] CVE-2014-3690: arch/x86/kvm/vmx
arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.17.2 on Intel processors does not ensure that the value in the CR4 control register remains the same after a VM entry, which allows host OS users to kill arbitrary processes or cause a denial of service (system disruption) by leveraging /dev/kvm access, as demonstrated by PR_SET_TSC prctl calls within a modified copy of QEMU.
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2014-11-25·CVSS 5.5
CVE-2014-3690 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
A flaw was discovered in how the Linux kernel's KVM (Kernel Virtual
Machine) subsystem handles the CR4 control register at VM entry on Intel
processors. A local host OS user can exploit this to cause a denial of
service (kill arbitrary processes, or system disruption) by leveraging
/dev/kvm access. (CVE-2014-3690)
Don Bailey discovered a flaw in the LZO decompress algorithm used by the
Linux kernel. An attacker could exploit this flaw to cause a denial of
service (memory corruption or OOPS). (CVE-2014-4608)
Andy Lutomirski discovered that the Linux kernel was not checking the
CAP_SYS_ADMIN when remounting filesystems to read-only. A local user could
exploit this flaw to cause a denial of serv
Ubuntu
Linux kernel (Trusty HWE) vulnerabilities
vendor_ubuntu·2014-11-25·CVSS 5.5
CVE-2014-3690 [MEDIUM] Linux kernel (Trusty HWE) vulnerabilities
Title: Linux kernel (Trusty HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
A flaw was discovered in how the Linux kernel's KVM (Kernel Virtual
Machine) subsystem handles the CR4 control register at VM entry on Intel
processors. A local host OS user can exploit this to cause a denial of
service (kill arbitrary processes, or system disruption) by leveraging
/dev/kvm access. (CVE-2014-3690)
Don Bailey discovered a flaw in the LZO decompress algorithm used by the
Linux kernel. An attacker could exploit this flaw to cause a denial of
service (memory corruption or OOPS). (CVE-2014-4608)
Andy Lutomirski discovered a flaw in how the Linux kernel handles
pivot_root when used with a chroot directory. A local user could exploit
this flaw to cause a denial of servi
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2014-11-25·CVSS 5.5
CVE-2014-3610 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
Nadav Amit reported that the KVM (Kernel Virtual Machine) mishandles
noncanonical addresses when emulating instructions that change the rip
(Instruction Pointer). A guest user with access to I/O or the MMIO can use
this flaw to cause a denial of service (system crash) of the guest.
(CVE-2014-3647)
A flaw was discovered with the handling of the invept instruction in the
KVM (Kernel Virtual Machine) subsystem of the Linux kernel. An unprivileged
guest user could exploit this flaw to cause a denial of service (system
crash) on the guest. (CVE-2014-3646)
A flaw was discovered with invept instruction support when using nested EPT
in the KVM (Kernel Virtual Machine). An unprivileged guest user coul
Ubuntu
Linux kernel (OMAP4) vulnerabilities
vendor_ubuntu·2014-11-25·CVSS 5.5
CVE-2014-3610 [MEDIUM] Linux kernel (OMAP4) vulnerabilities
Title: Linux kernel (OMAP4) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Nadav Amit reported that the KVM (Kernel Virtual Machine) mishandles
noncanonical addresses when emulating instructions that change the rip
(Instruction Pointer). A guest user with access to I/O or the MMIO can use
this flaw to cause a denial of service (system crash) of the guest.
(CVE-2014-3647)
A flaw was discovered with the handling of the invept instruction in the
KVM (Kernel Virtual Machine) subsystem of the Linux kernel. An unprivileged
guest user could exploit this flaw to cause a denial of service (system
crash) on the guest. (CVE-2014-3646)
A flaw was discovered with invept instruction support when using nested EPT
in the KVM (Kernel Virtual Machine). An unprivileged guest u
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2014-11-25·CVSS 5.5
CVE-2014-3690 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
A flaw was discovered in how the Linux kernel's KVM (Kernel Virtual
Machine) subsystem handles the CR4 control register at VM entry on Intel
processors. A local host OS user can exploit this to cause a denial of
service (kill arbitrary processes, or system disruption) by leveraging
/dev/kvm access. (CVE-2014-3690)
Don Bailey discovered a flaw in the LZO decompress algorithm used by the
Linux kernel. An attacker could exploit this flaw to cause a denial of
service (memory corruption or OOPS). (CVE-2014-4608)
Andy Lutomirski discovered a flaw in how the Linux kernel handles
pivot_root when used with a chroot directory. A local user could exploit
this flaw to cause a denial of service (mount-tre
Red Hat
kernel: kvm: vmx: invalid host cr4 handling across vm entries
vendor_redhat·2014-10-21·CVSS 5.5
CVE-2014-3690 [MEDIUM] kernel: kvm: vmx: invalid host cr4 handling across vm entries
kernel: kvm: vmx: invalid host cr4 handling across vm entries
arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.17.2 on Intel processors does not ensure that the value in the CR4 control register remains the same after a VM entry, which allows host OS users to kill arbitrary processes or cause a denial of service (system disruption) by leveraging /dev/kvm access, as demonstrated by PR_SET_TSC prctl calls within a modified copy of QEMU.
It was found that the Linux kernel's KVM implementation did not ensure that the host CR4 control register value remained unchanged across VM entries on the same virtual CPU. A local, unprivileged user could use this flaw to cause a denial of service on the system.
Statement: This issue does affects the Linux kernel packages as shipped w
Debian
CVE-2014-3690: linux - arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.17.2 on Int...
vendor_debian·2014·CVSS 5.5
CVE-2014-3690 [MEDIUM] CVE-2014-3690: linux - arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.17.2 on Int...
arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.17.2 on Intel processors does not ensure that the value in the CR4 control register remains the same after a VM entry, which allows host OS users to kill arbitrary processes or cause a denial of service (system disruption) by leveraging /dev/kvm access, as demonstrated by PR_SET_TSC prctl calls within a modified copy of QEMU.
Scope: local
bookworm: resolved (fixed in 3.16.7-1)
bullseye: resolved (fixed in 3.16.7-1)
forky: resolved (fixed in 3.16.7-1)
sid: resolved (fixed in 3.16.7-1)
trixie: resolved (fixed in 3.16.7-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2014-3690 kernel: kvm: vmx: invalid host cr4 handling across vm entries [fedora-all]
bugzilla·2014-10-22·CVSS 5.5
CVE-2014-3690 [MEDIUM] CVE-2014-3690 kernel: kvm: vmx: invalid host cr4 handling across vm entries [fedora-all]
CVE-2014-3690 kernel: kvm: vmx: invalid host cr4 handling across vm entries [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported v
Bugzilla
CVE-2014-3690 kernel: kvm: vmx: invalid host cr4 handling across vm entries
bugzilla·2014-10-15·CVSS 5.5
CVE-2014-3690 [MEDIUM] CVE-2014-3690 kernel: kvm: vmx: invalid host cr4 handling across vm entries
CVE-2014-3690 kernel: kvm: vmx: invalid host cr4 handling across vm entries
It was found that the host cr4 value can change across vm entries on the same
vcpu and yet it was being treated as being constant. This can interfere with,
for example, PR_SET_TSC settings (cr4/TSD bit), leading to inconsistent state.
A local, unprivileged user could use this flaw to cause denial of service on
the system.
Acknowledgements:
Red Hat would like to thank Andy Lutomirski for reporting this issue.
Discussion:
Statement:
This issue does affects the Linux kernel packages as shipped with Red Hat
Enterprise Linux 6 and 7. Future updates may address this issue in the
respective Red Hat Enterprise Linux releases.
This issue does affect the kvm packages as shipped with Red Hat Enterprise Linux 5, even t
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=d974baa398f34393db76be45f7d4d04fbdbb4a0ahttp://lists.opensuse.org/opensuse-security-announce/2015-01/msg00035.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-04/msg00015.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0290.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0782.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0864.htmlhttp://secunia.com/advisories/60174http://www.debian.org/security/2014/dsa-3060http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.17.2http://www.mandriva.com/security/advisories?name=MDVSA-2015:058http://www.openwall.com/lists/oss-security/2014/10/21/4http://www.openwall.com/lists/oss-security/2014/10/29/7http://www.securityfocus.com/bid/70691http://www.ubuntu.com/usn/USN-2417-1http://www.ubuntu.com/usn/USN-2418-1http://www.ubuntu.com/usn/USN-2419-1http://www.ubuntu.com/usn/USN-2420-1http://www.ubuntu.com/usn/USN-2421-1https://bugzilla.redhat.com/show_bug.cgi?id=1153322https://github.com/torvalds/linux/commit/d974baa398f34393db76be45f7d4d04fbdbb4a0ahttp://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=d974baa398f34393db76be45f7d4d04fbdbb4a0ahttp://lists.opensuse.org/opensuse-security-announce/2015-01/msg00035.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-04/msg00015.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0290.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0782.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0864.htmlhttp://secunia.com/advisories/60174http://www.debian.org/security/2014/dsa-3060http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.17.2http://www.mandriva.com/security/advisories?name=MDVSA-2015:058http://www.openwall.com/lists/oss-security/2014/10/21/4http://www.openwall.com/lists/oss-security/2014/10/29/7http://www.securityfocus.com/bid/70691http://www.ubuntu.com/usn/USN-2417-1http://www.ubuntu.com/usn/USN-2418-1http://www.ubuntu.com/usn/USN-2419-1http://www.ubuntu.com/usn/USN-2420-1http://www.ubuntu.com/usn/USN-2421-1https://bugzilla.redhat.com/show_bug.cgi?id=1153322https://github.com/torvalds/linux/commit/d974baa398f34393db76be45f7d4d04fbdbb4a0a
2014-11-10
Published