CVE-2014-0155: Input Validation
It was found that invalid entries in guest ioapic redirection table could lead to BUGON in ioapicdeliver() function.
A privileged user in the guest could use this flaw to crash the host.
Acknowledgements:
This issue was discovered by Red Hat.
Other sources
The ioapicdeliver function in virt/kvm/ioapic.c in the Linux kernel through 3.14.1 does not properly validate the kvmirqdeliverytoapic return value, which allows guest OS users to cause a denial of service (host OS crash) via a crafted entry in the redirection table of an I/O APIC. NOTE: the affected code was moved to the ioapicservice function before the vulnerability was announced.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0155?
CVE-2014-0155 is considered a high-severity vulnerability due to its potential to crash the host from a privileged guest.
How do I fix CVE-2014-0155?
To fix CVE-2014-0155, upgrade to a patched version of the Linux kernel as specified in the security advisories.
What are the affected versions in CVE-2014-0155?
CVE-2014-0155 affects Linux kernel versions prior to 3.14.1, as well as several specific versions of the Debian package 'linux'.
Can CVE-2014-0155 be exploited remotely?
CVE-2014-0155 requires a privileged user in the guest environment, meaning it cannot be exploited remotely without access to the guest.
What impact does CVE-2014-0155 have on systems?
The impact of CVE-2014-0155 is that it can lead to a system crash of the host operating system when exploited.