CVE-2010-0298

Publication date 12 February 2010

Last updated 24 July 2024

Ubuntu priority

Low

Why this priority?

The x86 emulator in KVM 83 does not use the Current Privilege Level (CPL) and I/O Privilege Level (IOPL) in determining the memory access available to CPL3 code, which allows guest OS users to cause a denial of service (guest OS crash) or gain privileges on the guest OS by leveraging access to a (1) IO port or (2) MMIO region, a related issue to CVE-2010-0306.

From the Ubuntu Security Team

It was discovered that KVM did not correctly limit certain privileged IO accesses on x86. Processes in the guest OS with access to IO regions could gain further privileges within the guest OS.

Read the notes from the security team

Status

No maintained releases are affected by this CVE.

Package Ubuntu Release Status
kvm 11.04 natty Not in release
10.10 maverick Not in release
10.04 LTS lucid Not in release
9.10 karmic Not in release
9.04 jaunty Ignored end of life
8.10 intrepid Ignored end of life, was needed
8.04 LTS hardy Ignored end of life
6.06 LTS dapper Not in release
linux 11.04 natty
Not affected
10.10 maverick
Not affected
10.04 LTS lucid
Fixed 2.6.32-22.35
9.10 karmic
Fixed 2.6.31-22.60
9.04 jaunty
Fixed 2.6.28-19.61
8.10 intrepid Ignored end of life, was needed
8.04 LTS hardy
Fixed 2.6.24-28.70
6.06 LTS dapper Not in release
linux-ec2 11.04 natty Not in release
10.10 maverick Ignored end of life
10.04 LTS lucid
Fixed 2.6.32-22.35
9.10 karmic
Fixed 2.6.31-307.15
9.04 jaunty Not in release
8.10 intrepid Not in release
8.04 LTS hardy Not in release
6.06 LTS dapper Not in release
linux-fsl-imx51 11.04 natty Not in release
10.10 maverick Not in release
10.04 LTS lucid
Fixed 2.6.31-608.14
9.10 karmic
Fixed 2.6.31-112.28
8.04 LTS hardy Not in release
6.06 LTS dapper Not in release
linux-lts-backport-maverick 11.04 natty Not in release
10.10 maverick Not in release
10.04 LTS lucid
Not affected
9.10 karmic Not in release
9.04 jaunty Not in release
8.10 intrepid Not in release
8.04 LTS hardy Not in release
6.06 LTS dapper Not in release
linux-mvl-dove 11.04 natty Not in release
10.10 maverick
Not affected
10.04 LTS lucid
Fixed 2.6.32-205.18
9.10 karmic
Fixed 2.6.31-214.28
8.04 LTS hardy Not in release
6.06 LTS dapper Not in release
linux-source-2.6.15 11.04 natty Not in release
10.10 maverick Not in release
10.04 LTS lucid Not in release
9.10 karmic Not in release
9.04 jaunty Not in release
8.10 intrepid Not in release
8.04 LTS hardy Not in release
6.06 LTS dapper
Not affected
linux-ti-omap4 11.04 natty
Not affected
10.10 maverick
Not affected
10.04 LTS lucid Not in release
9.10 karmic Not in release
8.04 LTS hardy Not in release
6.06 LTS dapper Not in release

Notes

kees

access to IO/MMIO requires elevated privileges, which already allows for guest OS disruption. No working upstream solution yet.

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
linux

References

Related Ubuntu Security Notices (USN)

    • USN-947-1
    • Linux kernel vulnerabilities
    • 3 June 2010

Other references