CVE-2010-0298: Medium severity Linux Linux kernel vulnerability
Gleb Natapov found a bug in KVM that allows code that runs in CPL3 (inside a guest) to modify memory in CPL0 (inside a guest). The bug is in x86 emulator code. When emulator accesses guest's memory on behalf of the gust's code it does this with the CPL0 privilege, so if emulated instruction is executed by unprivileged code it can still modify memory that otherwise is not accessible to it. To tak advantage of this vulnerability malicious code should trick KVM to emulate malicious instruction. KVM emulates IO and MMIO instructions, so if unprivileged process has access to some IO port or MMIO region (framebuffer for instance) the bug is very easy to use to modify arbitrary location in kernel memory.
Other sources
The x86 emulator in KVM 83 does not use the Current Privilege Level (CPL) and I/O Privilege Level (IOPL) in determining the memory access available to CPL3 code which allows guest OS users to cause a denial of service (guest OS crash) or gain privileges on the guest OS by leveraging access to a (1) IO port or (2) MMIO region a related issue to CVE-2010-0306.
— Microsoft
The x86 emulator in KVM 83 does not use the Current Privilege Level (CPL) and I/O Privilege Level (IOPL) in determining the memory access available to CPL3 code, which allows guest OS users to cause a denial of service (guest OS crash) or gain privileges on the guest OS by leveraging access to a (1) IO port or (2) MMIO region, a related issue to CVE-2010-0306.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-0298?
CVE-2010-0298 is classified as a medium severity vulnerability due to the potential for code execution in higher privilege levels.
How do I fix CVE-2010-0298?
To fix CVE-2010-0298, update your Linux kernel to a version later than 2.6.33 or apply relevant patches provided by your distribution.
What systems are affected by CVE-2010-0298?
CVE-2010-0298 affects various versions of the Linux kernel, particularly versions between 2.6.28 and 2.6.33, as well as Debian Linux 5.0.
What types of attacks can exploit CVE-2010-0298?
Exploitation of CVE-2010-0298 could allow an attacker to execute arbitrary code with elevated privileges within the guest operating system.
Are there workarounds for CVE-2010-0298?
There are no effective workarounds for CVE-2010-0298, and the best approach is to update the affected software.