CVE-2019-6974: Race Condition
A use after free issue was found in the way Linux kernel's KVM hypervisor implements its device control API. While creating a device via kvmioctlcreatedevice(), device holds a reference to a VM object, latter this reference is transferred to caller's file descriptor table. If such file descriptor was to be closed, reference count to the VM object could become zero, potentially leading to use-after-free issue latter.
A user/process could use this flaw to crash the guest VM resulting in DoS issue OR potentially gain privileged access to a system.
Upstream patch: --------------- -> https://git.kernel.org/linus/cfa39381173d5f969daf43582c95ad679189cbc9
Reference: ---------- -> https://www.openwall.com/lists/oss-security/2019/02/18/2
Other sources
In the Linux kernel before 4.20.8, kvmioctlcreatedevice in virt/kvm/kvmmain.c mishandles reference counting because of a race condition, leading to a use-after-free.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.7-1Fixed in 7.1.8-1 - Upgrade
Upgrade
Linux kernel KVM (kvm_ioctl_create_device)to a version that resolves this vulnerability.Fixed in 4.20.8Patch cfa39381173d5f969daf43582c95ad679189cbc9 - Operational
After upgrading past 4.20.8, restart/recapture any affected KVM guest sessions as needed to ensure the fixed KVM code paths are used.
Event History
Frequently Asked Questions
What is the severity of CVE-2019-6974?
CVE-2019-6974 is classified as a high severity vulnerability due to its potential impact on the Linux kernel's KVM hypervisor.
How do I fix CVE-2019-6974?
To address CVE-2019-6974, upgrade the Linux kernel to a version that includes the patch, such as those mentioned in the vulnerability details.
Which software versions are affected by CVE-2019-6974?
CVE-2019-6974 affects various versions of the Linux kernel, specifically those between versions 3.10 to 5.x before the remedied versions.
What type of vulnerability is CVE-2019-6974?
CVE-2019-6974 is categorized as a use after free vulnerability, which occurs when memory is accessed after it has been freed.
Can CVE-2019-6974 lead to unauthorized access?
Yes, CVE-2019-6974 could potentially allow an attacker to gain unauthorized access or execute arbitrary code through exploitation.