CVE-2014-8134: Low severity linux kernel vulnerability
It was found that espfix funcionality (when returning to userspace with a 16 bit stack, the CPU will not restore the high word of esp for us on executing iret and thus potentially leaks kernel addresses; espfix fixes this) does not work for 32-bit KVM paravirt guests.
A local unprivileged user could potentially use this flaw to leak kernel stack addresses.
Proposed upstream patch: http://www.spinics.net/lists/kvm/msg111458.html
Acknowledgements:
Red Hat would like to thank Andy Lutomirski for reporting this issue.
Other sources
The paravirtopssetup function in arch/x86/kernel/kvm.c in the Linux kernel through 3.18 uses an improper paravirtenabled setting for KVM guest kernels, which makes it easier for guest OS users to bypass the ASLR protection mechanism via a crafted application that reads a 16-bit value.
— Launchpad
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-8134?
CVE-2014-8134 is considered to be of medium severity due to its potential exploitation by local unprivileged users.
How do I fix CVE-2014-8134?
To fix CVE-2014-8134, update the Linux kernel to versions 5.10.223-1, 5.10.226-1, 6.1.123-1, or later versions.
What systems are affected by CVE-2014-8134?
CVE-2014-8134 affects various distributions including Debian, Ubuntu 12.04, 14.04, 16.04, openSUSE 13.1, and others.
Who can exploit CVE-2014-8134?
CVE-2014-8134 can be exploited by local unprivileged users with access to a 32-bit KVM paravirt guest.
What does CVE-2014-8134 affect specifically?
CVE-2014-8134 affects the espfix functionality, which may leak kernel addresses in certain conditions.