CVE-2015-5307: Medium severity linux kernel vulnerability
It was found that a guest can DoS a host by triggering an infinite loop in microcode. If a guest in 32-bit mode enabled alignment exceptions, puts the exception handler in ring 3, and then triggers an alignment exception with an unaligned stack, then the microcode will enter an infinite loop. Because there's no instruction boundary the core never receives another interrupt (including SMIs). The host kernel panics pretty quickly due to the effects.
A privileged user inside guest could use this flaw to crash the host kernel resulting in DoS.
Upstream KVM patch: ------------------- -> http://permalink.gmane.org/gmane.linux.kernel/2082329
References: ----------- -> http://www.openwall.com/lists/oss-security/2015/11/10/1
Other sources
It was found that the x86 ISA (Instruction Set Architecture) is prone to a denial of service attack inside a virtualized environment in the form of an infinite loop in the microcode due to the way (sequential) delivering of benign exceptions such as #AC (alignment check exception) is handled. A privileged user inside a guest could use this flaw to create denial of service conditions on the host kernel.
The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service (host OS panic or hang) by triggering many #AC (aka Alignment Check) exceptions, related to svm.c and vmx.c.
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2015-5307?
CVE-2015-5307 is considered a high severity vulnerability due to its potential for a denial of service attack.
How do I fix CVE-2015-5307?
To fix CVE-2015-5307, you should upgrade to the kernel versions specified in the remedy section, such as 0:2.6.32-573.12.1.el6 or later.
Which systems are affected by CVE-2015-5307?
CVE-2015-5307 affects various versions of Linux kernels, Xen hypervisors, and Oracle VM VirtualBox.
Can CVE-2015-5307 be exploited remotely?
Yes, CVE-2015-5307 can be exploited by an attacker with access to the guest system, leading to denial of service on the host.
What type of threat does CVE-2015-5307 pose?
CVE-2015-5307 poses a threat of denial of service due to an infinite loop triggered in the microcode.