CVE-2014-8134

 

Published at: - 12-12-2014 07:59

Last modified: - 21-09-2022 08:44

Total changes: - 2

Description

The paravirt_ops_setup function in arch/x86/kernel/kvm.c in the Linux kernel through 3.18 uses an improper paravirt_enabled setting for KVM guest kernels, which makes it easier for guest OS users to bypass the ASLR protection mechanism via a crafted application that reads a 16-bit value.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

 

Verification logic

 

Reference

• http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-8134.html
• [kvm] 20141205 [PATCH] x86, kvm: Clear paravirt_enabled on KVM guests for espfix32's benefit-Exploit, Mailing List, Patch, Third Party Advisory
• https://bugzilla.novell.com/show_bug.cgi?id=909078
• https://bugzilla.redhat.com/show_bug.cgi?id=1172765
• https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1400314
• 62336-Broken Link
• SUSE-SU-2015:0481-Mailing List, Third Party Advisory
• openSUSE-SU-2015:0566-Mailing List, Third Party Advisory
• SUSE-SU-2015:0736-Mailing List, Third Party Advisory
• http://www.oracle.com/technetwork/topics/security/linuxbulletinapr2016-2952096.html
• RHSA-2016:0855-Third Party Advisory
• 71650-Third Party Advisory, VDB Entry
• openSUSE-SU-2015:0714-Mailing List, Third Party Advisory
• https://support.f5.com/csp/article/K17120
• https://support.f5.com/csp/article/K17120?utm_source=f5support&utm_medium=RSS

 

Keywords

NVD

 

CVE-2014-8134

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures