CVE-2014-3610: Medium severity linux kernel vulnerability
If the guest writes a noncanonical value to certain MSR registers, KVM will write that value to the MSR in the host context and a #GP will be raised leading to kernel panic.
A privileged guest user can use this flaw to crash the host.
Enabling CONFIGPARAVIRT when building the kernel mitigates this issue because wrmsrl() ends up invoking safe msr write variant.
Acknowledgements:
Red Hat would like to thank Lars Bull of Google and Nadav Amit for reporting this issue.
Other sources
The WRMSR processing functionality in the KVM subsystem in the Linux kernel through 3.17.2 does not properly handle the writing of a non-canonical address to a model-specific register, which allows guest OS users to cause a denial of service (host OS crash) by leveraging guest OS privileges, related to the wrmsrinterception function in arch/x86/kvm/svm.c and the handlewrmsr function in arch/x86/kvm/vmx.c.
— Launchpad
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3610?
CVE-2014-3610 is considered a critical vulnerability that can lead to a kernel panic in the host system.
How do I fix CVE-2014-3610?
To fix CVE-2014-3610, you should update to the vulnerable software versions listed in the original documentation.
Which software versions are affected by CVE-2014-3610?
CVE-2014-3610 affects various versions of the Linux kernel, especially those prior to version 3.17.2.
What are the potential impacts of exploiting CVE-2014-3610?
Exploitation of CVE-2014-3610 allows a privileged guest user to crash the host system.
Is there a mitigation for CVE-2014-3610?
Enabling CONFIG_PARAVIRT when building the kernel is a mitigation strategy for CVE-2014-3610.