CVE-2013-1943: Input Validation
A check for valid userspace memory was found missing in kvmsetmemoryregion() function. Because of that, memory regions pointing to kernel memory could be registered with KVM and later used when converting guest physical addresses to host virtual ones. Several call sites relied on the validation and were using read/write functions that were missing the accessok() check when accessing userspace memory.
A local unprivileged user on Red Hat Enterprise Linux 6 system could use this flaw to escalate their privileges on the system.
On Red Hat Enterprise Linux 6.2 EUS and Red Hat Enterprise Linux 6.3 EUS the impact is limited to potential information leak only.
A local user on Red Hat Enterprise Linux 5 system able to write to /dev/kvm could possibly use this flaw to leak kernel memory.
Upstream fixes: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=fa3d315a4ce2c0891cdde262562e710d95fba19e https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9e3bb6b6f6a0c535eb053fbf0005a8e79e053374
Acknowledgements:
This issue was discovered by Michael S. Tsirkin of Red Hat.
Other sources
The KVM subsystem in the Linux kernel before 3.0 does not check whether kernel addresses are specified during allocation of memory slots for use in a guest's physical address space, which allows local users to gain privileges or obtain sensitive information from kernel memory via a crafted application, related to arch/x86/kvm/pagingtmpl.h and virt/kvm/kvmmain.c.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2013-1943?
CVE-2013-1943 is considered to have a high severity due to its potential to allow unauthorized access to kernel memory.
How do I fix CVE-2013-1943?
To fix CVE-2013-1943, upgrade to the appropriate patched version of the Linux kernel or affected distribution as specified in the advisory.
What versions are affected by CVE-2013-1943?
CVE-2013-1943 affects Linux kernel versions up to 3.0 and specific versions of Red Hat Enterprise Linux and Ubuntu.
What vulnerabilities does CVE-2013-1943 exploit?
CVE-2013-1943 exploits the lack of proper validation for userspace memory in the kvm_set_memory_region() function.
Is there a workaround for CVE-2013-1943?
There are no reliable workarounds for CVE-2013-1943; the best mitigation is to apply the security updates promptly.