Linux Kernel up to 5.3 KVM Hypervisor /dev/kvm out-of-bounds write

Summaryinfo

A vulnerability was found in Linux Kernel up to 5.3. It has been classified as critical. This affects an unknown function of the file /dev/kvm of the component KVM Hypervisor. The manipulation leads to out-of-bounds write. This vulnerability is uniquely identified as CVE-2019-14821. Local access is required to approach this attack. No exploit exists.

Detailsinfo

A vulnerability was found in Linux Kernel up to 5.3 (Operating System) and classified as critical. This issue affects an unknown code block of the file /dev/kvm of the component KVM Hypervisor. The manipulation with an unknown input leads to a out-of-bounds write vulnerability. Using CWE to declare the problem leads to CWE-787. The product writes data past the end, or before the beginning, of the intended buffer. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

An out-of-bounds access issue was found in the Linux kernel, all versions through 5.3, in the way Linux kernel's KVM hypervisor implements the Coalesced MMIO write operation. It operates on an MMIO ring buffer 'struct kvm_coalesced_mmio' object, wherein write indices 'ring->first' and 'ring->last' value could be supplied by a host user-space process. An unprivileged host user or process with access to '/dev/kvm' device could use this flaw to crash the host kernel, resulting in a denial of service or potentially escalating privileges on the system.

The weakness was disclosed 09/19/2019 as not defined bug report (Bugzilla). It is possible to read the advisory at bugzilla.redhat.com. The identification of this vulnerability is CVE-2019-14821 since 08/10/2019. Attacking locally is a requirement. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 12/26/2023).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entry VDB-153337 is pretty similar. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 5.0
• 5.1
• 5.2
• 5.3

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion