CVE-2014-3610

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2014-3610
The WRMSR processing functionality in the KVM subsystem in the Linux kernel through 3.17.2 does not properly handle the writing of a non-canonical address to a model-specific register, which allows guest OS users to cause a denial of service (host OS crash) by leveraging guest OS privileges, related to the wrmsr_interception function in arch/x86/kvm/svm.c and the handle_wrmsr function in arch/x86/kvm/vmx.c.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

4.9 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:L/AC:L/Au:N/C:N/I:N/A:C

Exploitability : 3.9 / Impact : 6.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact COMPLETE

References
Link Resource
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=854e8bb1aa06c578c2c9145fa6bfe3680ef63b23
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html Mailing List Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-0869.html Third Party Advisory
http://www.debian.org/security/2014/dsa-3060 Third Party Advisory
http://www.openwall.com/lists/oss-security/2014/10/24/9 Mailing List Patch Third Party Advisory
http://www.securityfocus.com/bid/70742 Third Party Advisory VDB Entry
http://www.ubuntu.com/usn/USN-2394-1 Third Party Advisory
http://www.ubuntu.com/usn/USN-2417-1 Third Party Advisory
http://www.ubuntu.com/usn/USN-2418-1 Third Party Advisory
http://www.ubuntu.com/usn/USN-2491-1 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1144883 Issue Tracking Patch Third Party Advisory
https://github.com/torvalds/linux/commit/854e8bb1aa06c578c2c9145fa6bfe3680ef63b23 Exploit Patch Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*

Configuration 3 (hide)

cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:o:opensuse:evergreen:11.4:*:*:*:*:*:*:*
cpe:2.3:o:suse:suse_linux_enterprise_server:11:sp2:*:*:ltss:*:*:*
History

13 Feb 2023, 00:41

Type Values Removed Values Added
Summary It was found that KVM's Write to Model Specific Register (WRMSR) instruction emulation would write non-canonical values passed in by the guest to certain MSRs in the host's context. A privileged guest user could use this flaw to crash the host. The WRMSR processing functionality in the KVM subsystem in the Linux kernel through 3.17.2 does not properly handle the writing of a non-canonical address to a model-specific register, which allows guest OS users to cause a denial of service (host OS crash) by leveraging guest OS privileges, related to the wrmsr_interception function in arch/x86/kvm/svm.c and the handle_wrmsr function in arch/x86/kvm/vmx.c.
References
  • {'url': 'https://access.redhat.com/security/cve/CVE-2014-3610', 'name': 'https://access.redhat.com/security/cve/CVE-2014-3610', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2015:0869', 'name': 'https://access.redhat.com/errata/RHSA-2015:0869', 'tags': [], 'refsource': 'MISC'}

02 Feb 2023, 20:17

Type Values Removed Values Added
Summary The WRMSR processing functionality in the KVM subsystem in the Linux kernel through 3.17.2 does not properly handle the writing of a non-canonical address to a model-specific register, which allows guest OS users to cause a denial of service (host OS crash) by leveraging guest OS privileges, related to the wrmsr_interception function in arch/x86/kvm/svm.c and the handle_wrmsr function in arch/x86/kvm/vmx.c. It was found that KVM's Write to Model Specific Register (WRMSR) instruction emulation would write non-canonical values passed in by the guest to certain MSRs in the host's context. A privileged guest user could use this flaw to crash the host.
References
  • {'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=854e8bb1aa06c578c2c9145fa6bfe3680ef63b23', 'name': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=854e8bb1aa06c578c2c9145fa6bfe3680ef63b23', 'tags': ['Exploit', 'Mailing List', 'Patch', 'Vendor Advisory'], 'refsource': 'CONFIRM'}
  • (MISC) http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=854e8bb1aa06c578c2c9145fa6bfe3680ef63b23 -
  • (MISC) https://access.redhat.com/security/cve/CVE-2014-3610 -
  • (MISC) https://access.redhat.com/errata/RHSA-2015:0869 -
Information

Published : 2014-11-10 11:55

Updated : 2023-12-10 11:31

NVD link : CVE-2014-3610

Mitre link : CVE-2014-3610

CVE.ORG link : CVE-2014-3610

JSON object : View

Products Affected

opensuse

  • evergreen

linux

  • linux_kernel

suse

  • suse_linux_enterprise_server

canonical

  • ubuntu_linux

debian

  • debian_linux
CWE
NVD-CWE-noinfo