vulnerability CVE-2009-2287

Linux kernel: denial of service via KVM and CR3

Synthesis of the vulnerability

An attacker inside a KVM guest system can use the CR3 register in order to generate a denial of service.

Severity: 1/4. Creation date: 30/06/2009.

Description of the vulnerability

The code of the KVM (Kernel Virtual Machine) uses the kvm_sregs structure to store Intel registers which are to be modified with KVM_SET_SREGS. The CR3 register (kvm_sregs.cr3) contains the base address of the Page Directory Table, used for memory paging. When the address indicated by CR3 is invalid, a NULL pointer is used by the gfn_to_rmap() function. This error leads to a denial of service. An attacker inside a KVM guest system can therefore use the CR3 register in order to generate a denial of service.

Complete Vigil@nce bulletin

Access to the complete Vigil@nce bulletin

Characteristics

Title: Linux kernel: denial of service via KVM and CR3. Keywords: CR3 Directory Intel KVM KVM_SET_SREGS Kernel Linux Machine NULL Page Table Virtual cr3 denial gfn_to_rmap kernel kvm_sregs service. Identifiers: BID-35529, CVE-2009-2287, DSA 1845-1, DSA-1846-1, VIGILANCE-VUL-8830.

Information sources

Publications and announces Source example: EXPLOITABLE failure to validate cr3 after KVM_SET_SREGS

Solutions for this vulnerability

Patch or workaround

Computer vulnerabilities tracking service

The Vigil@nce computer vulnerability tracking service alerts your teams of vulnerabilities or threats impacting your information system.
The Vigil@nce vulnerability database contains several thousand vulnerabilities.
This bulletin is published by the Vigil@nce team, which tracks computer vulnerabilities impacting systems and applications.
Computer vulnerability database