CVE-2009-2287: Null Pointer Dereference
The kvmarchvcpuioctlsetsregs function in the KVM in Linux kernel 2.6 before 2.6.30, when running on x86 systems, does not validate the page table root in a KVMSETSREGS call, which allows local users to cause a denial of service (crash or hang) via a crafted cr3 value, which triggers a NULL pointer dereference in the gfntormap function.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-2287?
CVE-2009-2287 is classified as a high-severity vulnerability due to its potential to cause denial of service.
How do I fix CVE-2009-2287?
To fix CVE-2009-2287, upgrade your Linux kernel to version 2.6.30 or later.
Which systems are affected by CVE-2009-2287?
CVE-2009-2287 affects Linux kernel versions before 2.6.30 running on x86 systems, as well as specific versions of Ubuntu and Debian.
Can CVE-2009-2287 lead to data loss?
While CVE-2009-2287 primarily causes denial of service, it may indirectly lead to data loss due to system crashes or hangs.
Are there any known exploits for CVE-2009-2287?
Yes, there are known exploits for CVE-2009-2287 that could allow local users to crash or hang affected systems through crafted KVM_SET_SREGS calls.