CVE-2015-3214: Buffer Overflow
Due converting PIO to the new memory read/write api we no longer provide separate I/O region lenghts for read and write operations. As a result, reading from PIT Mode/Command register will end with accessing pit->channels with invalid index and potentially cause memory corruption and/or minor information leak.
A privileged guest user in a guest with QEMU PIT emulation enabled could potentially (tough unlikely) use this flaw to execute arbitrary code on the host with the privileges of the hosting QEMU process. (QEMU part of the vulnerability)
A privileged guest user in a guest could potentially (tough unlikely) use this flaw to execute arbitrary code on the host. (KVM part of the vulnerability)
Acknowledgements:
Red Hat would like to thank Matt Tait of Google's Project Zero security team for reporting this issue.
Other sources
The pitioportread in i8254.c in the Linux kernel before 2.6.33 and QEMU before 2.3.1 does not distinguish between read lengths and write lengths, which might allow guest OS users to execute arbitrary code on the host OS by triggering use of an invalid index.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-3214?
CVE-2015-3214 is classified as a critical vulnerability due to its potential to cause memory corruption.
Which software versions are affected by CVE-2015-3214?
CVE-2015-3214 affects multiple versions of QEMU up to 2.3.0, several versions of Linux Kernel up to 2.6.32, and specific versions of Arista EOS and Red Hat software.
How do I fix CVE-2015-3214?
To fix CVE-2015-3214, it is recommended to update the affected software to the latest versions provided by the vendor that include security patches.
What are the potential impacts of CVE-2015-3214?
The potential impacts of CVE-2015-3214 include memory corruption and the possibility of system crashes or unstable behavior.
Is there a workaround for CVE-2015-3214?
Currently, there is no known workaround for CVE-2015-3214, and updating to a non-vulnerable version is advised.