The em_syscall function in arch/x86/kvm/emulate.c in the KVM implementation in the Linux kernel before 3.2.14 does not properly handle the 0f05 (aka syscall) opcode, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application, as demonstrated by an NASM file.

*   Products
    *   Openwall GNU/\*/Linux   _server OS_
    *   Linux Kernel Runtime Guard
    *   John the Ripper   _password cracker_
        *   Free & Open Source for any platform
        *   in the cloud
        *   Pro for Linux
        *   Pro for macOS
    *   Wordlists   _for password cracking_
    *   passwdqc   _policy enforcement_
        *   Free & Open Source for Unix
        *   Pro for Windows (Active Directory)
    *   yescrypt   _KDF & password hashing_
    *   yespower   _Proof-of-Work (PoW)_
    *   crypt\_blowfish   _password hashing_
    *   phpass   _ditto in PHP_
    *   tcb   _better password shadowing_
    *   Pluggable Authentication Modules
    *   scanlogd   _port scan detector_
    *   popa3d   _tiny POP3 daemon_
    *   blists   _web interface to mailing lists_
    *   msulogin   _single user mode login_
    *   php\_mt\_seed   _mt\_rand() cracker_
*   Services
*   Publications
    *   Articles
    *   Presentations
*   Resources
    *   Mailing lists
    *   Community wiki
    *   Source code repositories (GitHub)
    *   Source code repositories (CVSweb)
    *   File archive & mirrors
    *   How to verify digital signatures
    *   OVE IDs
*   What's new

\[<prev\] \[next>\] \[<thread-prev\] \[day\] \[month\] \[year\] \[list\]

Date: Wed, 11 Jan 2012 17:09:25 -0700
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request -- kernel: kvm: syscall instruction
 induced guest panic

On 01/11/2012 01:19 PM, Petr Matousek wrote:
> "32bit guests will crash (and 64bit guests may behave in a
> wrong way) for example by simply executing following
> nasm-demo-application:
>
>     \[bits 32\]
>     global \_start
>     SECTION .text
>     \_start: syscall
>
> The reason seems a missing "invalid opcode"-trap (int6) for the
> syscall opcode "0f05", which is not available on Intel CPUs
> within non-longmodes, as also on some AMD CPUs within legacy-mode.
> (depending on CPU vendor, MSR\_EFER and cpuid)
>
> Because previous mentioned OSs may not engage corresponding
> syscall target-registers (STAR, LSTAR, CSTAR), they remain
> NULL and (non trapping) syscalls are leading to multiple
> faults and finally crashs."
>
> References:
> https://bugzilla.redhat.com/show\_bug.cgi?id=773370
> https://lkml.org/lkml/2011/12/28/170
> http://www.spinics.net/lists/kvm/msg66633.html
>
> Proposed patch:
> http://www.spinics.net/lists/kvm/msg66633.html
>
> Credits:
> Stephan Bärwolf
>
> Introduced by:
> e66bb2ccdcf76d032bbb464b35c292bb3ee58f9b in linux-2.6.32
>
> Thanks,
Please use CVE-2012-0045 for this issue.

-- 

-- Kurt Seifried / Red Hat Security Response Team

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.

CVE-2012-0045: oss-security - Re: CVE request -

The sctp_rcv_ootb function in the SCTP implementation in the Linux kernel before 2.6.23 allows remote attackers to cause a denial of service (infinite loop) via (1) an Out Of The Blue (OOTB) chunk or (2) a chunk of zero length.

CVE-2010-0008: Red Hat Customer Portal - Access to 24x7 support and knowledge

Multiple race conditions in fs/pipe.c in the Linux kernel before 2.6.32-rc6 allow local users to cause a denial of service (NULL pointer dereference and system crash) or gain privileges by attempting to open an anonymous pipe via a /proc/*/fd/ pathname.

**Description**

The kernel-rt packages contain the Linux kernel, the core of any Linux  
operating system.  

Security fixes:  

*   the ADDR\_COMPAT\_LAYOUT and MMAP\_PAGE\_ZERO flags were not cleared when a

setuid or setgid program was executed. A local, unprivileged user could use  
this flaw to bypass the mmap\_min\_addr protection mechanism and perform a  
NULL pointer dereference attack, or bypass the Address Space Layout  
Randomization (ASLR) security feature. (CVE-2009-1895, Important)  

*   a system with SELinux enforced was more permissive in allowing local

users in the unconfined\_t domain to map low memory areas even if the  
mmap\_min\_addr restriction was enabled. This could aid in the local  
exploitation of NULL pointer dereference bugs. (CVE-2009-2695, Important)  

*   missing initialization flaws were found in getname() implementations in

numerous network protocol implementations in the Linux kernel. Certain  
data structures in these getname() implementations were not initialized  
properly before being copied to user-space. These flaws could lead to an  
information leak. (CVE-2009-3002, Important)  

*   a NULL pointer dereference flaw was found in each of the following

functions in the Linux kernel: pipe\_read\_open(), pipe\_write\_open(), and  
pipe\_rdwr\_open(). When the mutex lock is not held, the i\_pipe pointer could  
be released by other processes before it is used to update the pipe's  
reader and writer counters. This could lead to a local denial of service or  
privilege escalation. (CVE-2009-3547, Important)  

*   a flaw was found in the Realtek r8169 Ethernet driver in the Linux

kernel. pci\_unmap\_single() presented a memory leak that could lead to IOMMU  
space exhaustion and a system crash. An attacker on the local network could  
abuse this flaw by using jumbo frames for large amounts of network traffic.  
(CVE-2009-3613, Important)  

*   NULL pointer dereference flaws were found in the r128 driver in the

Linux kernel. Checks to test if the Concurrent Command Engine state was  
initialized were missing in private IOCTL functions. An attacker could use  
these flaws to cause a local denial of service or escalate their  
privileges. (CVE-2009-3620, Important)  

*   Kees Cook and Steve Beattie discovered a race condition in the /proc

code in the Linux kernel. This could lead to information in the  
"/proc/\[pid\]/maps" and "/proc/\[pid\]/smaps" files being leaked to users (who  
would otherwise not have access to this information) during ELF loading.  
This could help a local attacker bypass the ASLR security feature.  
(CVE-2009-2691, Moderate)  

*   a NULL pointer dereference flaw was found in the md driver in the Linux

kernel. If the suspend\_lo or suspend\_hi file in "/sys/" is modified when  
the disk array is inactive, it could lead to a local denial of service or  
privilege escalation. By default, only root can write to these two files.  
(CVE-2009-2849, Moderate)  

*   an information leak was found in the Linux kernel. On AMD64 systems,

32-bit processes could access and read certain 64-bit registers by  
temporarily switching themselves to 64-bit mode. (CVE-2009-2910, Moderate)  

*   padding data in several core network structures was not initialized

properly before being sent to user-space, possibly leading to information  
leaks. (CVE-2009-3228, CVE-2009-3612, Moderate)  

*   the unix\_stream\_connect() function in the Linux kernel did not check if a

UNIX domain socket was in the shutdown state. This could lead to a  
deadlock. A local, unprivileged user could use this flaw to cause a denial  
of service. (CVE-2009-3621, Moderate)  

These updated packages also include bug fixes and enhancements. Users are  
directed to the Realtime Security Update Release Notes for version 1.1 for  
information on these changes, which will be available shortly from:  

http://www.redhat.com/docs/en-US/Red\_Hat\_Enterprise\_MRG/

Users should upgrade to these updated packages, which contain backported  
patches to correct these issues and add enhancements. The system must be  
rebooted for this update to take effect.

CVE-2009-3547

CRLF injection vulnerability in xterm allows user-assisted attackers to execute arbitrary commands via LF (aka \n) characters surrounding a command name within a Device Control Request Status String (DECRQSS) escape sequence in a text file, a related issue to CVE-2003-0063 and CVE-2003-0071.

Tag

#amd