CVE-2015-0239: Medium severity linux kernel vulnerability
It was found that the Linux kernel KVM subsystem's sysenter instruction emulation was not sufficient.
An unprivileged guest user could use this flaw to escalate their privileges by tricking the hypervisor to emulate a SYSENTER instruction in 16-bit mode, if the guest OS does not initialize the SYSENTER MSRs.
Please note that the Red Hat Enterprise Linux with KVM certified guest operating systems do initialize the SYSENTER MSRs and are thus not vulnerable to this issue when running on KVM hypervisor.
References: http://www.openwall.com/lists/oss-security/2015/01/27/6
Upstream patch: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f3747379accba8e95d70cec0eae0582c8c182050
Acknowledgements:
Red Hat would like to thank Nadav Amit for reporting this issue.
Other sources
The emsysenter function in arch/x86/kvm/emulate.c in the Linux kernel before 3.18.5, when the guest OS lacks SYSENTER MSR initialization, allows guest OS users to gain guest OS privileges or cause a denial of service (guest OS crash) by triggering use of a 16-bit code segment for emulation of a SYSENTER instruction.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-0239?
CVE-2015-0239 has a medium severity level as it allows unprivileged users to escalate privileges on affected systems.
How do I fix CVE-2015-0239?
To fix CVE-2015-0239, update the Linux kernel to version 3.18.5 or later versions provided by your distribution.
Which systems are affected by CVE-2015-0239?
CVE-2015-0239 affects various versions of the Linux kernel, particularly those prior to 3.18.5, and specific distributions like Ubuntu, Debian, and Red Hat.
Can CVE-2015-0239 be exploited remotely?
CVE-2015-0239 requires an attacker to have an unprivileged account on the guest system, so it cannot be exploited remotely.
Is there a known exploit for CVE-2015-0239?
As of now, there are no public exploits available for CVE-2015-0239, but the vulnerability itself poses a significant risk if left unpatched.