CVE-2013-1798: Input Validation
Description of the problem: If the guest specifies a IOAPICREGSELECT with an invalid value and follows that with a read of the IOAPICREGWINDOW KVM does not properly validate that request. ioapicreadindirect contains an ASSERT(redirindex < IOAPICNUMPINS), but the ASSERT has no effect in non-debug builds. In recent kernels this allows a guest to cause a kernel oops by reading invalid memory. In older kernels (pre-3.3) this allows a guest to read from large ranges of host memory.
Acknowledgements:
Red Hat would like to thank Andrew Honig of Google for reporting this issue.
Other sources
The ioapicreadindirect function in virt/kvm/ioapic.c in the Linux kernel through 3.8.4 does not properly handle a certain combination of invalid IOAPICREGSELECT and IOAPICREGWINDOW operations, which allows guest OS users to obtain sensitive information from host OS memory or cause a denial of service (host OS OOPS) via a crafted application.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-1798?
CVE-2013-1798 has a medium severity rating due to the potential for an attacker to exploit the invalid value in the IOAPIC_REG_SELECT.
How do I fix CVE-2013-1798?
To fix CVE-2013-1798, upgrade to a patched version of the Linux kernel, specifically versions 5.10.223-1, 5.10.226-1, 6.1.119-1, 6.1.123-1, 6.12.11-1, or 6.12.12-1.
Which versions of Linux Kernel are affected by CVE-2013-1798?
CVE-2013-1798 affects Linux Kernel versions 3.8.0 up to and including 3.8.4.
What is the nature of the vulnerability in CVE-2013-1798?
CVE-2013-1798 is a vulnerability that allows improper validation of an IOAPIC read request, potentially leading to unexpected system behavior.
Who can exploit CVE-2013-1798?
An attacker who has access to the guest environment can exploit CVE-2013-1798 by sending an invalid IOAPIC_REG_SELECT value.