CVE-2014-8369: Buffer Overflow
A flaw was found in the way iommu mapping failures were handled in kvmiommumappages() function in the Linux kernel (introduced by the fix for CVE-2014-3601).
A privileged user in the guest could use this flaw to crash the host in case the guest has access to passed in device.
Introduced by: http://git.kernel.org/cgit/virt/kvm/kvm.git/commit/?id=350b8bdd689cd2ab2c67c8a86a0be86cfa0751a7
Upstream patch: http://git.kernel.org/cgit/virt/kvm/kvm.git/commit/?id=3d32e4dbe71374a6780eaf51d719d76f9a9bf22f
Other sources
The kvmiommumappages function in virt/kvm/iommu.c in the Linux kernel through 3.17.2 miscalculates the number of pages during the handling of a mapping failure, which allows guest OS users to cause a denial of service (host OS page unpinning) or possibly have unspecified other impact by leveraging guest OS privileges. NOTE: this vulnerability exists because of an incorrect fix for CVE-2014-3601.
— Launchpad
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability CVE-2014-8369 about?
CVE-2014-8369 is a flaw in the Linux kernel's handling of iommu mapping failures which can allow a privileged user in a guest to crash the host system.
What versions of the Linux kernel are affected by CVE-2014-8369?
CVE-2014-8369 affects Linux kernel versions up to 3.17.2, including certain distributions like Debian 7.0 and OpenSUSE 11.4.
What is the severity of CVE-2014-8369?
CVE-2014-8369 has been classified as a high severity vulnerability due to the potential for a privileged user to crash the host.
How do I fix CVE-2014-8369?
To fix CVE-2014-8369, update the Linux kernel to a version that is not vulnerable, such as 5.10.223-1 or later releases.
Who can exploit CVE-2014-8369?
CVE-2014-8369 can be exploited by a privileged user within a guest virtual machine.