oss-security - CVE request: kvm: update_cr8_intercept() NULL pointer dereference when running without an apic

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Fri, 23 Oct 2009 11:47:00 +0800
From: Eugene Teo <eugeneteo@...nel.sg>
To: oss-security@...ts.openwall.com
CC: "Steven M. Christey" <coley@...us.mitre.org>
Subject: CVE request: kvm: update_cr8_intercept() NULL pointer dereference
 when running without an apic

Quote from the upstream commit:
"update_cr8_intercept() can be triggered from userspace while there
is no apic present."

http://git.kernel.org/linus/88c808fd42b53a7e01a2ac3253ef31fef74cb5af

This one can be triggered via kvm_vcpu_ioctl() if /dev/kvm is user 
accessible (which is recommended...). Fixed in v2.6.32-rc1.

Eugene

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.