CVE-2013-1935

A certain Red Hat patch to the KVM subsystem in the kernel package before 2.6.32-358.11.1.el6 on Red Hat Enterprise Linux (RHEL) 6 does not properly implement the PV EOI feature, which allows guest OS users to cause a denial of service (host OS crash) by leveraging a time window during which interrupts are disabled but copy_to_user function calls are possible.

CVSS v2.0 5.7 MEDIUM

5.7^/10

CVSS v2.0 : MEDIUM

Vector : AV:A/AC:M/Au:N/C:N/I:N/A:C

Exploitability : 5.5 / Impact : 6.9

Access Vector ADJACENT_NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact COMPLETE

References

Link	Resource
http://rhn.redhat.com/errata/RHSA-2013-0911.html	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=949981
https://rhn.redhat.com/errata/RHSA-2013-0907.html

Configurations

Configuration 1 (hide)

cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*

History

No history.

Information

Published : 2013-07-16 14:08

Updated : 2023-12-10 11:16

NVD link : CVE-2013-1935

Mitre link : CVE-2013-1935

CVE.ORG link : CVE-2013-1935

JSON object : View

Products Affected

redhat

enterprise_linux

CWE

CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

{"id": "CVE-2013-1935", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.7, "accessVector": "ADJACENT_NETWORK", "vectorString": "AV:A/AC:M/Au:N/C:N/I:N/A:C", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 6.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 5.5, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2013-07-16T14:08:49.110", "references": [{"url": "http://rhn.redhat.com/errata/RHSA-2013-0911.html", "tags": ["Vendor Advisory"], "source": "secalert@redhat.com"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=949981", "source": "secalert@redhat.com"}, {"url": "https://rhn.redhat.com/errata/RHSA-2013-0907.html", "source": "secalert@redhat.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-362"}]}], "descriptions": [{"lang": "en", "value": "A certain Red Hat patch to the KVM subsystem in the kernel package before 2.6.32-358.11.1.el6 on Red Hat Enterprise Linux (RHEL) 6 does not properly implement the PV EOI feature, which allows guest OS users to cause a denial of service (host OS crash) by leveraging a time window during which interrupts are disabled but copy_to_user function calls are possible."}, {"lang": "es", "value": "Un parche de Red Hat para el subsistema KVM en el paquete del kernel anterior a 2.6.32-358.11.1.el6 para Red Hat Enterprise Linux (RHEL) 6 no implemente adecuadamente la caracter\u00edstica PV EOI, lo que permite a los usuarios de los sistemas operativos invitados (guest) provocar una denegaci\u00f3n de servicio (ca\u00edda del sistema del host) aprovechando una ventana de tiempo durante la que las interrupciones son desactivadas pero las funciones de copy_to_user a\u00fan son posibles."}], "lastModified": "2019-04-22T17:48:00.643", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2F6AB192-9D7D-4A9A-8995-E53A9DE9EAFC"}], "operator": "OR"}]}], "sourceIdentifier": "secalert@redhat.com"}