CVE-2015-0239

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2015-0239
The em_sysenter function in arch/x86/kvm/emulate.c in the Linux kernel before 3.18.5, when the guest OS lacks SYSENTER MSR initialization, allows guest OS users to gain guest OS privileges or cause a denial of service (guest OS crash) by triggering use of a 16-bit code segment for emulation of a SYSENTER instruction.

4.4 /10

CVSS v2.0 : MEDIUM

V2 Legend

Vector : AV:L/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 3.4 / Impact : 6.4

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=f3747379accba8e95d70cec0eae0582c8c182050
http://permalink.gmane.org/gmane.linux.kernel.commits.head/502245 Broken Link
http://rhn.redhat.com/errata/RHSA-2015-1272.html Third Party Advisory
http://www.debian.org/security/2015/dsa-3170 Third Party Advisory
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.18.5 Release Notes Vendor Advisory
http://www.mandriva.com/security/advisories?name=MDVSA-2015:058 Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/01/27/6 Exploit Mailing List Third Party Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html Third Party Advisory
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html Third Party Advisory
http://www.securityfocus.com/bid/72842 Third Party Advisory VDB Entry
http://www.ubuntu.com/usn/USN-2513-1 Third Party Advisory
http://www.ubuntu.com/usn/USN-2514-1 Third Party Advisory
http://www.ubuntu.com/usn/USN-2515-1 Third Party Advisory
http://www.ubuntu.com/usn/USN-2516-1 Third Party Advisory
http://www.ubuntu.com/usn/USN-2517-1 Third Party Advisory
http://www.ubuntu.com/usn/USN-2518-1 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1186448 Issue Tracking Third Party Advisory
https://github.com/torvalds/linux/commit/f3747379accba8e95d70cec0eae0582c8c182050 Patch Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.10:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:o:oracle:linux:5:-:*:*:*:*:*:*
cpe:2.3:o:oracle:linux:7:-:*:*:*:*:*:*

Configuration 5 (hide)

OR cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:*
History

13 Feb 2023, 00:45

Type Values Removed Values Added
Summary It was found that the Linux kernel KVM subsystem's sysenter instruction emulation was not sufficient. An unprivileged guest user could use this flaw to escalate their privileges by tricking the hypervisor to emulate a SYSENTER instruction in 16-bit mode, if the guest OS did not initialize the SYSENTER model-specific registers (MSRs). Note: Certified guest operating systems for Red Hat Enterprise Linux with KVM do initialize the SYSENTER MSRs and are thus not vulnerable to this issue when running on a KVM hypervisor. The em_sysenter function in arch/x86/kvm/emulate.c in the Linux kernel before 3.18.5, when the guest OS lacks SYSENTER MSR initialization, allows guest OS users to gain guest OS privileges or cause a denial of service (guest OS crash) by triggering use of a 16-bit code segment for emulation of a SYSENTER instruction.
References
  • {'url': 'https://access.redhat.com/errata/RHSA-2015:1272', 'name': 'https://access.redhat.com/errata/RHSA-2015:1272', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/security/cve/CVE-2015-0239', 'name': 'https://access.redhat.com/security/cve/CVE-2015-0239', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2015:2152', 'name': 'https://access.redhat.com/errata/RHSA-2015:2152', 'tags': [], 'refsource': 'MISC'}

02 Feb 2023, 20:20

Type Values Removed Values Added
References
  • {'url': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=f3747379accba8e95d70cec0eae0582c8c182050', 'name': 'http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=f3747379accba8e95d70cec0eae0582c8c182050', 'tags': ['Patch', 'Vendor Advisory'], 'refsource': 'CONFIRM'}
  • (MISC) http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=f3747379accba8e95d70cec0eae0582c8c182050 -
  • (MISC) https://access.redhat.com/errata/RHSA-2015:1272 -
  • (MISC) https://access.redhat.com/security/cve/CVE-2015-0239 -
  • (MISC) https://access.redhat.com/errata/RHSA-2015:2152 -
Summary The em_sysenter function in arch/x86/kvm/emulate.c in the Linux kernel before 3.18.5, when the guest OS lacks SYSENTER MSR initialization, allows guest OS users to gain guest OS privileges or cause a denial of service (guest OS crash) by triggering use of a 16-bit code segment for emulation of a SYSENTER instruction. It was found that the Linux kernel KVM subsystem's sysenter instruction emulation was not sufficient. An unprivileged guest user could use this flaw to escalate their privileges by tricking the hypervisor to emulate a SYSENTER instruction in 16-bit mode, if the guest OS did not initialize the SYSENTER model-specific registers (MSRs). Note: Certified guest operating systems for Red Hat Enterprise Linux with KVM do initialize the SYSENTER MSRs and are thus not vulnerable to this issue when running on a KVM hypervisor.
Information

Published : 2015-03-02 11:59

Updated : 2023-12-10 11:31

NVD link : CVE-2015-0239

Mitre link : CVE-2015-0239

CVE.ORG link : CVE-2015-0239

JSON object : View

Products Affected

oracle

  • linux

canonical

  • ubuntu_linux

redhat

  • enterprise_linux_workstation
  • enterprise_linux_desktop
  • enterprise_linux_server

linux

  • linux_kernel

debian

  • debian_linux
CWE
CWE-269

Improper Privilege Management