CVE-2014-0077: Medium severity Linux Linux kernel vulnerability
A flaw was found in the way handlerx() function handled big packets when mergeable buffers were disabled.
A privileged user in the guest could use this flaw to crash the host, or, potentially, escalate their privileges to the ones of the hosting qemu process by corrupting qemu memory.
Acknowledgements:
This issue was discovered by Michael S. Tsirkin of Red Hat.
Other sources
drivers/vhost/net.c in the Linux kernel before 3.13.10, when mergeable buffers are disabled, does not properly validate packet lengths, which allows guest OS users to cause a denial of service (memory corruption and host OS crash) or possibly gain privileges on the host OS via crafted packets, related to the handlerx and getrxbufs functions.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1 - Upgrade
Upgrade
Linux kernel drivers/vhost/net.cto a version that resolves this vulnerability.Fixed in 3.13.10
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0077?
CVE-2014-0077 is considered a high-severity vulnerability due to its potential to crash the host or enable privilege escalation.
How do I fix CVE-2014-0077?
To fix CVE-2014-0077, update to a patched version of the Linux kernel that addresses this flaw.
Which versions of Linux are affected by CVE-2014-0077?
CVE-2014-0077 affects Linux kernel versions prior to 3.13.10.
Can CVE-2014-0077 be exploited remotely?
No, CVE-2014-0077 requires a privileged user in the guest environment to exploit the vulnerability.
What systems are at risk for CVE-2014-0077?
Systems running vulnerable versions of the Linux kernel in a virtualized environment are at risk for CVE-2014-0077.