CVE-2011-4347: Medium severity linux kernel vulnerability
It was found that kvmvmioctlassigndevice function did not check if the user requesting assignment was privileged or not. Together with /dev/kvm being 666, unprivileged user could assign unused pci devices, or even devices that were in use and whose resources were not properly claimed by the respective drivers.
Please note that privileged access was still needed to re-program the device to for example issue DMA requests. This is typically achieved by touching files on sysfs filesystem. These files are usually not accessible to unprivileged users.
As a result, local user could use this flaw to crash the system.
Reference: http://thread.gmane.org/gmane.comp.emulators.kvm.devel/82043
Acknowledgements:
Red Hat would like to thank Sasha Levin for reporting this issue.
Other sources
The kvmvmioctlassigndevice function in virt/kvm/assigned-dev.c in ...
— Debian
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2011-4347?
CVE-2011-4347 is considered to have a high severity due to potential privilege escalation risks.
How do I fix CVE-2011-4347?
To fix CVE-2011-4347, update to a patched version of the Linux kernel that addresses this vulnerability.
Which versions of the Linux kernel are affected by CVE-2011-4347?
CVE-2011-4347 affects Linux kernel versions up to 3.1.9, including specific versions like 3.1.1 to 3.1.8.
What vulnerability type is CVE-2011-4347?
CVE-2011-4347 describes a privilege escalation vulnerability related to device assignment in KVM.
Who can be impacted by CVE-2011-4347?
CVE-2011-4347 can impact unprivileged users who can potentially assign PCI devices improperly through the KVM interface.