CVE-2019-6974
published 2019-02-15CVE-2019-6974: In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because of a race condition, leading to a…
PriorityP266high8.1CVSS 3.1
AVNACHPRNUINSUCHIHAH
EXPLOIT
EPSS
16.52%
96.7th percentile
In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because of a race condition, leading to a use-after-free.
Affected
68 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | linux | < linux 4.19.20-1 (bookworm) | linux 4.19.20-1 (bookworm) |
| f5 | big-ip_access_policy_manager | 13.0.0 – 13.1.1 | — |
| f5 | big-ip_access_policy_manager | 14.0.0 – 14.1.0 | — |
| f5 | big-ip_access_policy_manager | >= 15.0.0 < 15.1.0 | 15.1.0 |
| f5 | big-ip_advanced_firewall_manager | 13.0.0 – 13.1.1 | — |
| f5 | big-ip_advanced_firewall_manager | 14.0.0 – 14.1.0 | — |
| f5 | big-ip_advanced_firewall_manager | >= 15.0.0 < 15.1.0 | 15.1.0 |
| f5 | big-ip_analytics | 13.0.0 – 13.1.1 | — |
| f5 | big-ip_analytics | 14.0.0 – 14.1.0 | — |
| f5 | big-ip_analytics | >= 15.0.0 < 15.1.0 | 15.1.0 |
| f5 | big-ip_application_acceleration_manager | 13.0.0 – 13.1.1 | — |
| f5 | big-ip_application_acceleration_manager | 14.0.0 – 14.1.0 | — |
| f5 | big-ip_application_acceleration_manager | >= 15.0.0 < 15.1.0 | 15.1.0 |
| f5 | big-ip_application_security_manager | 13.0.0 – 13.1.1 | — |
| f5 | big-ip_application_security_manager | 14.0.0 – 14.1.0 | — |
| f5 | big-ip_application_security_manager | >= 15.0.0 < 15.1.0 | 15.1.0 |
| f5 | big-ip_edge_gateway | 13.0.0 – 13.1.1 | — |
| f5 | big-ip_edge_gateway | 14.0.0 – 14.1.0 | — |
| f5 | big-ip_edge_gateway | >= 15.0.0 < 15.1.0 | 15.1.0 |
Detection & IOCsextracted from sources · hover to see the quote
- →The exploit triggers the race by predicting the file descriptor number and racing a close() call against kvm_ioctl_create_device(). Monitor for rapid repeated close() syscalls on predicted KVM device FDs from the same thread, combined with KVM_CREATE_VM and KVM_CREATE_DEVICE ioctls. ↗
- →The vulnerability is in virt/kvm/kvm_main.c:kvm_ioctl_create_device(). Kernel crash signatures include NULL pointer dereference at address 0x00000000000000a8 in down_write(), or kernel paging request faults in kvm_vm_ioctl(), both triggered by use-after-free of the kvm object. ↗
- →Kernel oops call trace includes kvm_put_kvm, kvm_vm_release, __fput, task_work_run, do_exit — indicating the VM object refcount dropped to zero prematurely due to the race. Alert on kernel oops with this call trace pattern. ↗
- →The exploit can be run in a loop to reliably trigger the crash on unpatched kernels. Monitor for repeated rapid executions of a process issuing KVM_CREATE_VM followed by KVM_CREATE_DEVICE ioctls on /dev/kvm. ↗
- →Affected Linux kernel versions are before 4.20.8. Ensure kernel version is patched; Red Hat Enterprise Linux 7 was confirmed affected while RHEL 5, 6, and MRG 2 were not. ↗
- ·The race window is narrow and exploitation requires local access to /dev/kvm. The crash may take multiple attempts in a loop to trigger on unpatched kernels without the artificial msleep(100) delay. ↗
- ·This issue does not affect Red Hat Enterprise Linux 5, 6, or Red Hat Enterprise MRG 2. Only RHEL 7 (and kernels before 4.20.8) are affected. ↗
CVSS provenance
nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
osv8.1HIGH
vendor_debian8.1HIGH
vendor_redhat8.1HIGH
vendor_ubuntu7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-gvrg-rwmc-m69h: In the Linux kernel before 4
ghsa_unreviewed·2022-05-13
CVE-2019-6974 [HIGH] CWE-362 GHSA-gvrg-rwmc-m69h: In the Linux kernel before 4
In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because of a race condition, leading to a use-after-free.
OSV
linux, linux-aws, linux-gcp, linux-kvm, linux-oem, linux-oracle, linux-raspi2 vulnerabilities
osv·2019-04-02·CVSS 7.8
CVE-2018-14678 [HIGH] linux, linux-aws, linux-gcp, linux-kvm, linux-oem, linux-oracle, linux-raspi2 vulnerabilities
linux, linux-aws, linux-gcp, linux-kvm, linux-oem, linux-oracle, linux-raspi2 vulnerabilities
M. Vefa Bicakci and Andy Lutomirski discovered that the kernel did not
properly set up all arguments to an error handler callback used when
running as a paravirtualized guest. An unprivileged attacker in a
paravirtualized guest VM could use this to cause a denial of service (guest
VM crash). (CVE-2018-14678)
It was discovered that the KVM implementation in the Linux kernel on ARM
64bit processors did not properly handle some ioctls. An attacker with the
privilege to create KVM-based virtual machines could use this to cause a
denial of service (host system crash) or execute arbitrary code in the
host. (CVE-2018-18021)
Mathias Payer and Hui Peng discovered a use-after-free vulnerability in the
Ad
OSV
linux-lts-xenial, linux-aws vulnerabilities
osv·2019-04-02·CVSS 7.0
CVE-2017-18249 [HIGH] linux-lts-xenial, linux-aws vulnerabilities
linux-lts-xenial, linux-aws vulnerabilities
USN-3932-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu
14.04 LTS.
It was discovered that a race condition existed in the f2fs file system
implementation in the Linux kernel. A local attacker could use this to
cause a denial of service. (CVE-2017-18249)
Wen Xu discovered that the f2fs file system implementation in the Linux
kernel did not properly validate metadata. An attacker could use this to
construct a malicious f2fs image that, when mounted, could cause a denial
of service (system crash). (CVE-2018-13097, CVE-2018-13099, CVE-2018-13100,
CVE-2018-14614, CVE-2018-14616)
Wen Xu and Po-Ning Tseng
OSV
linux-hwe, linux-azure vulnerabilities
osv·2019-04-02·CVSS 7.8
CVE-2018-19824 [HIGH] linux-hwe, linux-azure vulnerabilities
linux-hwe, linux-azure vulnerabilities
USN-3930-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.10.
This update provides the corresponding updates for the Linux Hardware
Enablement (HWE) kernel from Ubuntu 18.10 for Ubuntu 18.04 LTS.
Mathias Payer and Hui Peng discovered a use-after-free vulnerability in the
Advanced Linux Sound Architecture (ALSA) subsystem. A physically proximate
attacker could use this to cause a denial of service (system crash).
(CVE-2018-19824)
Shlomi Oberman, Yuli Shapiro, and Ran Menscher discovered an information
leak in the Bluetooth implementation of the Linux kernel. An attacker
within Bluetooth range could use this to expose sensitive information
(kernel memory). (CVE-2019-3459, CVE-2019-3460)
Jann Horn discovered that the KVM implementation in th
OSV
linux vulnerabilities
osv·2019-04-02·CVSS 7.5
CVE-2017-1000410 [HIGH] linux vulnerabilities
linux vulnerabilities
It was discovered that an information leak vulnerability existed in the
Bluetooth implementation of the Linux kernel. An attacker within Bluetooth
range could possibly expose sensitive information (kernel memory).
(CVE-2017-1000410)
It was discovered that the USB serial device driver in the Linux kernel did
not properly validate baud rate settings when debugging is enabled. A local
attacker could use this to cause a denial of service (system crash).
(CVE-2017-18360)
Mathias Payer and Hui Peng discovered a use-after-free vulnerability in the
Advanced Linux Sound Architecture (ALSA) subsystem. A physically proximate
attacker could use this to cause a denial of service (system crash).
(CVE-2018-19824)
Shlomi Oberman, Yuli Shapiro, and Ran Menscher discovered an infor
OSV
linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities
osv·2019-04-02·CVSS 7.0
CVE-2017-18249 [HIGH] linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities
linux, linux-aws, linux-kvm, linux-raspi2, linux-snapdragon vulnerabilities
It was discovered that a race condition existed in the f2fs file system
implementation in the Linux kernel. A local attacker could use this to
cause a denial of service. (CVE-2017-18249)
Wen Xu discovered that the f2fs file system implementation in the Linux
kernel did not properly validate metadata. An attacker could use this to
construct a malicious f2fs image that, when mounted, could cause a denial
of service (system crash). (CVE-2018-13097, CVE-2018-13099, CVE-2018-13100,
CVE-2018-14614, CVE-2018-14616)
Wen Xu and Po-Ning Tseng discovered that btrfs file system implementation
in the Linux kernel did not properly validate metadata. An attacker could
use this to construct a malicious btrfs image that, when mo
OSV
linux-hwe, linux-aws-hwe, linux-azure, linux-gcp, linux-oracle vulnerabilities
osv·2019-04-02·CVSS 7.8
[HIGH] linux-hwe, linux-aws-hwe, linux-azure, linux-gcp, linux-oracle vulnerabilities
linux-hwe, linux-aws-hwe, linux-azure, linux-gcp, linux-oracle vulnerabilities
USN-3931-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 18.04 LTS for Ubuntu
16.04 LTS and for the Linux Azure kernel for Ubuntu 14.04 LTS.
M. Vefa Bicakci and Andy Lutomirski discovered that the kernel did not
properly set up all arguments to an error handler callback used when
running as a paravirtualized guest. An unprivileged attacker in a
paravirtualized guest VM could use this to cause a denial of service (guest
VM crash). (CVE-2018-14678)
It was discovered that the KVM implementation in the Linux kernel on ARM
64bit processors did not properly handle some ioctls. An attacker with
OSV
CVE-2019-6974: In the Linux kernel before 4
osv·2019-02-15·CVSS 8.1
CVE-2019-6974 [HIGH] CVE-2019-6974: In the Linux kernel before 4
In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because of a race condition, leading to a use-after-free.
Kernel
Merge tag 'v5.0-rc6' into for-5.1/block
kernel_security·2019-02-15·CVSS 8.1
CVE-2019-6974 [HIGH] Merge tag 'v5.0-rc6' into for-5.1/block
Merge tag 'v5.0-rc6' into for-5.1/block
Pull in 5.0-rc6 to avoid a dumb merge conflict with fs/iomap.c.
This is needed since io_uring is now based on the block branch,
to avoid a conflict between the multi-page bvecs and the bits
of io_uring that touch the core block parts.
* tag 'v5.0-rc6': (525 commits)
Linux 5.0-rc6
x86/mm: Make set_pmd_at() paravirt aware
MAINTAINERS: Update the ocores i2c bus driver maintainer, etc
blk-mq: remove duplicated definition of blk_mq_freeze_queue
Blk-iolatency: warn on negative inflight IO counter
blk-iolatency: fix IO hang due to negative inflight counter
MAINTAINERS: unify reference to xen-devel list
x86/mm/cpa: Fix set_mce_nospec()
futex: Handle early deadlock return correctly
futex: Fix barrier comment
net: dsa: b53: Fix for failure when irq is not de
Kernel
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm
kernel_security·2019-02-07·CVSS 8.1
CVE-2019-6974 [HIGH] Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm
Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm
Pull KVM fixes from Paolo Bonzini:
"Three security fixes"
* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
KVM: nVMX: unconditionally cancel preemption timer in free_nested (CVE-2019-7221)
KVM: x86: work around leak of uninitialized stack contents (CVE-2019-7222)
kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974)
Kernel
kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974)
kernel_security·2019-01-26·CVSS 8.1
CVE-2019-6974 [HIGH] kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974)
kvm: fix kvm_ioctl_create_device() reference counting (CVE-2019-6974)
kvm_ioctl_create_device() does the following:
1. creates a device that holds a reference to the VM object (with a borrowed
reference, the VM's refcount has not been bumped yet)
2. initializes the device
3. transfers the reference to the device to the caller's file descriptor table
4. calls kvm_get_kvm() to turn the borrowed reference to the VM into a real
reference
The ownership transfer in step 3 must not happen before the reference to the VM
becomes a proper, non-borrowed reference, which only happens in step 4.
After step 3, an attacker can close the file descriptor and drop the borrowed
reference, which can cause the refcount of the kvm object to drop to zero.
This means that we need to grab a reference for the d
Ubuntu
Linux kernel (HWE) vulnerabilities
vendor_ubuntu·2019-04-02·CVSS 7.8
CVE-2018-14678 [HIGH] Linux kernel (HWE) vulnerabilities
Title: Linux kernel (HWE) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
USN-3931-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 18.04 LTS for Ubuntu
16.04 LTS and for the Linux Azure kernel for Ubuntu 14.04 LTS.
M. Vefa Bicakci and Andy Lutomirski discovered that the kernel did not
properly set up all arguments to an error handler callback used when
running as a paravirtualized guest. An unprivileged attacker in a
paravirtualized guest VM could use this to cause a denial of service (guest
VM crash). (CVE-2018-14678)
It was discovered that the KVM implementation in the Linux kernel on ARM
64bit processors did not properly handle
Ubuntu
Linux kernel (HWE) vulnerabilities
vendor_ubuntu·2019-04-02·CVSS 7.8
CVE-2018-19824 [HIGH] Linux kernel (HWE) vulnerabilities
Title: Linux kernel (HWE) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
USN-3930-1 fixed vulnerabilities in the Linux kernel for Ubuntu 18.10.
This update provides the corresponding updates for the Linux Hardware
Enablement (HWE) kernel from Ubuntu 18.10 for Ubuntu 18.04 LTS.
Mathias Payer and Hui Peng discovered a use-after-free vulnerability in the
Advanced Linux Sound Architecture (ALSA) subsystem. A physically proximate
attacker could use this to cause a denial of service (system crash).
(CVE-2018-19824)
Shlomi Oberman, Yuli Shapiro, and Ran Menscher discovered an information
leak in the Bluetooth implementation of the Linux kernel. An attacker
within Bluetooth range could use this to expose sensitive information
(kernel memory). (CVE-2019-3459, C
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2019-04-02·CVSS 7.0
CVE-2017-18249 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that a race condition existed in the f2fs file system
implementation in the Linux kernel. A local attacker could use this to
cause a denial of service. (CVE-2017-18249)
Wen Xu discovered that the f2fs file system implementation in the Linux
kernel did not properly validate metadata. An attacker could use this to
construct a malicious f2fs image that, when mounted, could cause a denial
of service (system crash). (CVE-2018-13097, CVE-2018-13099, CVE-2018-13100,
CVE-2018-14614, CVE-2018-14616)
Wen Xu and Po-Ning Tseng discovered that btrfs file system implementation
in the Linux kernel did not properly validate metadata. An attacker could
use this to construct a malicious
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2019-04-02·CVSS 7.8
CVE-2018-14678 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
M. Vefa Bicakci and Andy Lutomirski discovered that the kernel did not
properly set up all arguments to an error handler callback used when
running as a paravirtualized guest. An unprivileged attacker in a
paravirtualized guest VM could use this to cause a denial of service (guest
VM crash). (CVE-2018-14678)
It was discovered that the KVM implementation in the Linux kernel on ARM
64bit processors did not properly handle some ioctls. An attacker with the
privilege to create KVM-based virtual machines could use this to cause a
denial of service (host system crash) or execute arbitrary code in the
host. (CVE-2018-18021)
Mathias Payer and Hui Peng discovered a use-after-free vulnerability i
Ubuntu
Linux kernel (Trusty HWE) vulnerabilities
vendor_ubuntu·2019-04-02·CVSS 7.5
CVE-2017-1000410 [HIGH] Linux kernel (Trusty HWE) vulnerabilities
Title: Linux kernel (Trusty HWE) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
USN-3933-1 fixed vulnerabilities in the Linux kernel for Ubuntu 14.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 14.04 LTS for Ubuntu
12.04 ESM.
It was discovered that an information leak vulnerability existed in the
Bluetooth implementation of the Linux kernel. An attacker within Bluetooth
range could possibly expose sensitive information (kernel memory).
(CVE-2017-1000410)
It was discovered that the USB serial device driver in the Linux kernel did
not properly validate baud rate settings when debugging is enabled. A local
attacker could use this to cause a denial of service (system crash).
(CVE-2017-18360
Ubuntu
Linux kernel (Xenial HWE) vulnerabilities
vendor_ubuntu·2019-04-02·CVSS 7.0
CVE-2017-18249 [HIGH] Linux kernel (Xenial HWE) vulnerabilities
Title: Linux kernel (Xenial HWE) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
USN-3932-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu
14.04 LTS.
It was discovered that a race condition existed in the f2fs file system
implementation in the Linux kernel. A local attacker could use this to
cause a denial of service. (CVE-2017-18249)
Wen Xu discovered that the f2fs file system implementation in the Linux
kernel did not properly validate metadata. An attacker could use this to
construct a malicious f2fs image that, when mounted, could cause a denial
of service (system crash). (CVE-2018-13097, CVE-2018-13099, CVE
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2019-04-02·CVSS 7.8
CVE-2018-19824 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Mathias Payer and Hui Peng discovered a use-after-free vulnerability in the
Advanced Linux Sound Architecture (ALSA) subsystem. A physically proximate
attacker could use this to cause a denial of service (system crash).
(CVE-2018-19824)
Shlomi Oberman, Yuli Shapiro, and Ran Menscher discovered an information
leak in the Bluetooth implementation of the Linux kernel. An attacker
within Bluetooth range could use this to expose sensitive information
(kernel memory). (CVE-2019-3459, CVE-2019-3460)
Jann Horn discovered that the KVM implementation in the Linux kernel
contained a use-after-free vulnerability. An attacker in a guest VM with
access to /dev/kvm could use this to cause a denial of
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2019-04-02·CVSS 7.5
CVE-2017-1000410 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that an information leak vulnerability existed in the
Bluetooth implementation of the Linux kernel. An attacker within Bluetooth
range could possibly expose sensitive information (kernel memory).
(CVE-2017-1000410)
It was discovered that the USB serial device driver in the Linux kernel did
not properly validate baud rate settings when debugging is enabled. A local
attacker could use this to cause a denial of service (system crash).
(CVE-2017-18360)
Mathias Payer and Hui Peng discovered a use-after-free vulnerability in the
Advanced Linux Sound Architecture (ALSA) subsystem. A physically proximate
attacker could use this to cause a denial of service (system crash).
(CVE
Red Hat
Kernel: KVM: potential use-after-free via kvm_ioctl_create_device()
vendor_redhat·2019-02-07·CVSS 8.1
CVE-2019-6974 [HIGH] CWE-416 Kernel: KVM: potential use-after-free via kvm_ioctl_create_device()
Kernel: KVM: potential use-after-free via kvm_ioctl_create_device()
In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because of a race condition, leading to a use-after-free.
A use-after-free vulnerability was found in the way the Linux kernel's KVM hypervisor implements its device control API. While creating a device via kvm_ioctl_create_device(), the device holds a reference to a VM object, later this reference is transferred to the caller's file descriptor table. If such file descriptor was to be closed, reference count to the VM object could become zero, potentially leading to a use-after-free issue. A user/process could use this flaw to crash the guest VM resulting in a denial of service issue or, potentially, gain privi
Debian
CVE-2019-6974: linux - In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main....
vendor_debian·2019·CVSS 8.1
CVE-2019-6974 [HIGH] CVE-2019-6974: linux - In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main....
In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because of a race condition, leading to a use-after-free.
Scope: local
bookworm: resolved (fixed in 4.19.20-1)
bullseye: resolved (fixed in 4.19.20-1)
forky: resolved (fixed in 4.19.20-1)
sid: resolved (fixed in 4.19.20-1)
trixie: resolved (fixed in 4.19.20-1)
No detection rules found.
Bugzilla
CVE-2019-6974 kernel: KVM: potential use-after-free via kvm_ioctl_create_device() [fedora-all]
bugzilla·2019-02-07·CVSS 8.1
CVE-2019-6974 [HIGH] CVE-2019-6974 kernel: KVM: potential use-after-free via kvm_ioctl_create_device() [fedora-all]
CVE-2019-6974 kernel: KVM: potential use-after-free via kvm_ioctl_create_device() [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple s
Bugzilla
CVE-2019-6974 kernel: KVM: potential use-after-free via kvm_ioctl_create_device() [fedora-all]
bugzilla·2019-02-07·CVSS 8.1
CVE-2019-6974 [HIGH] CVE-2019-6974 kernel: KVM: potential use-after-free via kvm_ioctl_create_device() [fedora-all]
CVE-2019-6974 kernel: KVM: potential use-after-free via kvm_ioctl_create_device() [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple s
Bugzilla
CVE-2019-6974 Kernel: KVM: potential use-after-free via kvm_ioctl_create_device()
bugzilla·2019-02-02·CVSS 8.1
CVE-2019-6974 [HIGH] CVE-2019-6974 Kernel: KVM: potential use-after-free via kvm_ioctl_create_device()
CVE-2019-6974 Kernel: KVM: potential use-after-free via kvm_ioctl_create_device()
A use after free issue was found in the way Linux kernel's KVM hypervisor
implements its device control API. While creating a device via
kvm_ioctl_create_device(), device holds a reference to a VM object,
latter this reference is transferred to caller's file descriptor table.
If such file descriptor was to be closed, reference count to the VM
object could become zero, potentially leading to use-after-free
issue latter.
A user/process could use this flaw to crash the guest VM resulting in
DoS issue OR potentially gain privileged access to a system.
Upstream patch:
-> https://git.kernel.org/linus/cfa39381173d5f969daf43582c95ad679189cbc9
Reference:
-> https://www.openwall.com/lists/oss-security/2019/02/18/2
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cfa39381173d5f969daf43582c95ad679189cbc9http://www.securityfocus.com/bid/107127https://access.redhat.com/errata/RHBA-2019:0959https://access.redhat.com/errata/RHSA-2019:0818https://access.redhat.com/errata/RHSA-2019:0833https://access.redhat.com/errata/RHSA-2019:2809https://access.redhat.com/errata/RHSA-2019:3967https://access.redhat.com/errata/RHSA-2020:0103https://bugs.chromium.org/p/project-zero/issues/detail?id=1765https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.99https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.21https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.20.8https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.156https://github.com/torvalds/linux/commit/cfa39381173d5f969daf43582c95ad679189cbc9https://lists.debian.org/debian-lts-announce/2019/03/msg00034.htmlhttps://lists.debian.org/debian-lts-announce/2019/04/msg00004.htmlhttps://lists.debian.org/debian-lts-announce/2019/05/msg00002.htmlhttps://support.f5.com/csp/article/K11186236https://support.f5.com/csp/article/K11186236?utm_source=f5support&%3Butm_medium=RSShttps://usn.ubuntu.com/3930-1/https://usn.ubuntu.com/3930-2/https://usn.ubuntu.com/3931-1/https://usn.ubuntu.com/3931-2/https://usn.ubuntu.com/3932-1/https://usn.ubuntu.com/3932-2/https://usn.ubuntu.com/3933-1/https://usn.ubuntu.com/3933-2/https://www.exploit-db.com/exploits/46388/http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cfa39381173d5f969daf43582c95ad679189cbc9http://www.securityfocus.com/bid/107127https://access.redhat.com/errata/RHBA-2019:0959https://access.redhat.com/errata/RHSA-2019:0818https://access.redhat.com/errata/RHSA-2019:0833https://access.redhat.com/errata/RHSA-2019:2809https://access.redhat.com/errata/RHSA-2019:3967https://access.redhat.com/errata/RHSA-2020:0103https://bugs.chromium.org/p/project-zero/issues/detail?id=1765https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.99https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.21https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.20.8https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.156https://github.com/torvalds/linux/commit/cfa39381173d5f969daf43582c95ad679189cbc9https://lists.debian.org/debian-lts-announce/2019/03/msg00034.htmlhttps://lists.debian.org/debian-lts-announce/2019/04/msg00004.htmlhttps://lists.debian.org/debian-lts-announce/2019/05/msg00002.htmlhttps://support.f5.com/csp/article/K11186236https://support.f5.com/csp/article/K11186236?utm_source=f5support&%3Butm_medium=RSShttps://usn.ubuntu.com/3930-1/https://usn.ubuntu.com/3930-2/https://usn.ubuntu.com/3931-1/https://usn.ubuntu.com/3931-2/https://usn.ubuntu.com/3932-1/https://usn.ubuntu.com/3932-2/https://usn.ubuntu.com/3933-1/https://usn.ubuntu.com/3933-2/https://www.exploit-db.com/exploits/46388/
2019-02-15
Published