Bug 541160 (CVE-2009-4031)
| Summary: | CVE-2009-4031 kernel: KVM: x86 emulator: limit instructions to 15 bytes | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Eugene Teo (Security Response) <eteo> |
| Component: | vulnerability | Assignee: | Nobody <nobody> |
| Status: | VERIFIED --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | arozansk, knoel |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 541164, 541165, 545637, 545645 | ||
| Bug Blocks: | |||
|
Description
Eugene Teo (Security Response)
2009-11-25 05:03:06 UTC
Mitre's CVE-2009-4031 record: ----------------------------- The do_insn_fetch function in arch/x86/kvm/emulate.c in the x86 emulator in the KVM subsystem in the Linux kernel before 2.6.32-rc8-next-20091125 tries to interpret instructions that contain too many bytes to be valid, which allows guest OS users to cause a denial of service (increased scheduling latency) on the host OS via unspecified manipulations related to SMP support. References: ----------- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4031 http://www.openwall.com/lists/oss-security/2009/11/25/3 http://www.openwall.com/lists/oss-security/2009/11/25/1 http://git.kernel.org/?p=linux/kernel/git/avi/kvm.git;a=commit;h=e42d9b8141d1f54ff72ad3850bb110c95a5f3b88 http://www.kernel.org/pub/linux/kernel/v2.6/next/patch-v2.6.32-rc8-next-20091125.gz The fix has been merged into the upstream tree now: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=eb3c79e64a70fb8f7473e30fa07e89c1ecc2c9bb This issue has been addressed in following products: Red Hat Enterprise Linux 5 Via RHSA-2009:1659 https://rhn.redhat.com/errata/RHSA-2009-1659.html kernel-2.6.27.41-170.2.117.fc10 has been submitted as an update for Fedora 10. http://admin.fedoraproject.org/updates/kernel-2.6.27.41-170.2.117.fc10 kernel-2.6.27.41-170.2.117.fc10 has been pushed to the Fedora 10 stable repository. If problems still persist, please make note of it in this bug report. This issue has been addressed in following products: Red Hat Enterprise Virtualization for RHEL-5 Via RHSA-2009:1692 https://rhn.redhat.com/errata/RHSA-2009-1692.html Patch present on current RHEL6 git tree. |