CVE-2010-0419: Medium severity Kvm Qumranet Kvm vulnerability
Paolo Bonzini found a bug in KVM that can be used to bypass proper permission checking while loading segment selectors. Malicious guest userspace process running in SMP guest can trick the emulator into loading kernel segment selector if it has access to IO port or MMIO region. To do so it should run legitimate instruction that does IO and will cause vcpu to enter emulator in one thread and replace this instruction to kernel selector loading one from another thread. If instruction is replaced after KVM entered emulator, but before instruction is fetched emulator will be tricked to execute privileged instruction without permission checking.
Other sources
The x86 emulator in KVM 83, when a guest is configured for Symmetric Multiprocessing (SMP), does not properly restrict writing of segment selectors to segment registers, which might allow guest OS users to cause a denial of service (guest OS crash) or gain privileges on the guest OS by leveraging access to a (1) IO port or (2) MMIO region, and replacing an instruction in between emulator entry and instruction fetch.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2010-0419?
CVE-2010-0419 has been assigned a medium severity rating due to the potential for unauthorized access to kernel memory.
How do I fix CVE-2010-0419?
To mitigate CVE-2010-0419, it is recommended to apply the latest patches or updates provided by the vendor for KVM.
What systems are affected by CVE-2010-0419?
CVE-2010-0419 affects KVM version 83 and might impact systems running this version.
What type of vulnerability is CVE-2010-0419?
CVE-2010-0419 is a privilege escalation vulnerability that allows unauthorized access by exploiting flaws in permission checking.
Can CVE-2010-0419 be exploited remotely?
CVE-2010-0419 primarily requires local access to the compromised guest environment to exploit the vulnerability.