CVE-2013-1796: Buffer Overflow
Description of the problem: If the guest sets the GPA of the timepage so that the request to update the time straddles a page then KVM will write onto an incorrect page. The write is done byusing kmap atomic to get a pointer to the page for the time structure and then performing a memcpy to that page starting at an offset that the guest controls. Well behaved guests always provide a 32-byte aligned address, however a malicious guest could use this to corrupt host kernel memory.
Acknowledgements:
Red Hat would like to thank Andrew Honig of Google for reporting this issue.
Other sources
The kvmsetmsrcommon function in arch/x86/kvm/x86.c in the Linux kernel through 3.8.4 does not ensure a required timepage alignment during an MSRKVMSYSTEMTIME operation, which allows guest OS users to cause a denial of service (buffer overflow and host OS memory corruption) or possibly have unspecified other impact via a crafted application.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-1796?
CVE-2013-1796 is considered a moderate severity vulnerability that affects data integrity in the Linux kernel.
How can I fix CVE-2013-1796?
To fix CVE-2013-1796, upgrade to a patched version of the Linux kernel such as 5.10.223-1, 5.10.226-1, or any version later than 3.8.4.
Which versions of the Linux kernel are affected by CVE-2013-1796?
CVE-2013-1796 affects Linux kernel versions up to and including 3.8.4 and specific earlier versions such as 3.8.0 to 3.8.3.
What type of vulnerability is CVE-2013-1796?
CVE-2013-1796 is a memory handling vulnerability that can lead to incorrect memory writes in the Linux kernel.
Is CVE-2013-1796 exploitable in a virtualized environment?
Yes, CVE-2013-1796 is exploitable in virtualized environments that utilize KVM.