News
Vigil@nce: Linux kernel, denial of service via KVM and CR3
July 2009 by Vigil@nce
An attacker inside a KVM guest system can use the CR3 register in order to generate a denial of service.
Severity: 1/4
Consequences: denial of service of computer
Provenance: user shell
Means of attack: no proof of concept, no attack
Ability of attacker: expert (4/4)
Confidence: confirmed by the editor (5/5)
Diffusion of the vulnerable configuration: high (3/3)
Creation date: 30/06/2009
IMPACTED PRODUCTS
Linux kernel
DESCRIPTION OF THE VULNERABILITY
The code of the KVM (Kernel Virtual Machine) uses the kvm_sregs structure to store Intel registers which are to be modified with KVM_SET_SREGS.
The CR3 register (kvm_sregs.cr3) contains the base address of the Page Directory Table, used for memory paging.
When the address indicated by CR3 is invalid, a NULL pointer is used by the gfn_to_rmap() function. This error leads to a denial of service.
An attacker inside a KVM guest system can therefore use the CR3 register in order to generate a denial of service.
CHARACTERISTICS
Identifiers: VIGILANCE-VUL-8830 http://vigilance.fr/vulnerability/Linux-kernel-denial-of-service-via-KVM-and-CR3-8830
