oss-security - Re: CVE Request: kernel: kvm: failure to validate cr3 after KVM_SET

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [<thread-prev] [month] [year] [list]

Date: Wed, 1 Jul 2009 08:02:30 -0400 (EDT)
From: "Steven M. Christey" <coley@...us.mitre.org>
To: oss-security@...ts.openwall.com
cc: "Steven M. Christey" <coley@...us.mitre.org>
Subject: Re: CVE Request: kernel: kvm: failure to validate
 cr3 after KVM_SET_SREGS

======================================================
Name: CVE-2009-2287
Status: Candidate
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2287
Reference: MLIST:[oss-security] 20090630 CVE Request: kernel: kvm: failure to validate cr3 after KVM_SET_SREGS
Reference: URL:http://www.openwall.com/lists/oss-security/2009/06/30/1
Reference: CONFIRM:http://git.kernel.org/?p=linux/kernel/git/stable/stable-queue.git;a=blob;f=queue-2.6.30/kvm-x86-check-for-cr3-validity-in-ioctl_set_sregs.patch;h=b48a47dad2cf76358b327368f80c0805e6370c68;hb=e7c45b24f298b5d9efd7d401150f64a1b51aaac4
Reference: CONFIRM:http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=59839dfff5eabca01cc4e20b45797a60a80af8cb
Reference: CONFIRM:http://sourceforge.net/tracker/?func=detail&atid=893831&aid=2687641&group_id=180599

The kvm_arch_vcpu_ioctl_set_sregs function in the KVM in Linux kernel
2.6 before 2.6.30, when running on x86 systems, does not validate the
page table root in a KVM_SET_SREGS call, which allows local users to
cause a denial of service (crash or hang) via a crafted cr3 value,
which triggers a NULL pointer dereference in the gfn_to_rmap function.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.