Red Hat Bugzilla – Bug 541160
CVE-2009-4031 kernel: KVM: x86 emulator: limit instructions to 15 bytes
Last modified: 2018-08-28 17:49:23 EDT
Description of problem: While we are never normally passed an instruction that exceeds 15 bytes, smp games can cause us to attempt to interpret one, which will cause large latencies in non-preempt hosts. Upstream commit: http://git.kernel.org/?p=linux/kernel/git/avi/kvm.git;a=commitdiff;h=e42d9b8141d1f54ff72ad3850bb110c95a5f3b88
Mitre's CVE-2009-4031 record: ----------------------------- The do_insn_fetch function in arch/x86/kvm/emulate.c in the x86 emulator in the KVM subsystem in the Linux kernel before 2.6.32-rc8-next-20091125 tries to interpret instructions that contain too many bytes to be valid, which allows guest OS users to cause a denial of service (increased scheduling latency) on the host OS via unspecified manipulations related to SMP support. References: ----------- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4031 http://www.openwall.com/lists/oss-security/2009/11/25/3 http://www.openwall.com/lists/oss-security/2009/11/25/1 http://git.kernel.org/?p=linux/kernel/git/avi/kvm.git;a=commit;h=e42d9b8141d1f54ff72ad3850bb110c95a5f3b88 http://www.kernel.org/pub/linux/kernel/v2.6/next/patch-v2.6.32-rc8-next-20091125.gz
The fix has been merged into the upstream tree now: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=eb3c79e64a70fb8f7473e30fa07e89c1ecc2c9bb
This issue has been addressed in following products: Red Hat Enterprise Linux 5 Via RHSA-2009:1659 https://rhn.redhat.com/errata/RHSA-2009-1659.html
kernel-2.6.27.41-170.2.117.fc10 has been submitted as an update for Fedora 10. http://admin.fedoraproject.org/updates/kernel-2.6.27.41-170.2.117.fc10
kernel-2.6.27.41-170.2.117.fc10 has been pushed to the Fedora 10 stable repository. If problems still persist, please make note of it in this bug report.
This issue has been addressed in following products: Red Hat Enterprise Virtualization for RHEL-5 Via RHSA-2009:1692 https://rhn.redhat.com/errata/RHSA-2009-1692.html
Patch present on current RHEL6 git tree.