--- title: "CVE-2010-0306\n | Ubuntu" description: Ubuntu is an open source software operating system that runs from the desktop, to the cloud, to all your internet connected things. url: https://ubuntu.com/security/CVE-2010-0306?format=md keywords: index, follow --- # CVE-2010-0306 Publication date 12 February 2010 Last updated 24 July 2024 --- Ubuntu priority **Low** [Why this priority?](https://ubuntu.com/security/cves/about#priority ) Toggle side navigation ## Description The x86 emulator in KVM 83, when a guest is configured for Symmetric Multiprocessing (SMP), does not use the Current Privilege Level (CPL) and I/O Privilege Level (IOPL) to restrict instruction execution, which allows guest OS users to cause a denial of service (guest OS crash) or gain privileges on the guest OS by leveraging access to a (1) IO port or (2) MMIO region, and replacing an instruction in between emulator entry and instruction fetch, a related issue to CVE-2010-0298. ### From the Ubuntu Security Team It was discovered that KVM did not correctly limit certain privileged IO accesses on x86. Processes in the guest OS with access to IO regions could gain further privileges within the guest OS. [Read the notes from the security team](https://ubuntu.com/security/CVE-2010-0306?format=md#notes) ## Status Show unmaintained releases | Package | Ubuntu Release | Status | | --- | --- | --- | | kvm | 11.04 natty | Not in release | | 10.10 maverick | Not in release | | 10.04 LTS lucid | Not in release | | 9.10 karmic | Not in release | | 9.04 jaunty | Ignored end of life | | 8.10 intrepid | Ignored end of life, was needed | | 8.04 LTS hardy | Ignored end of life | | 6.06 LTS dapper | Not in release | | linux | 11.04 natty | Not affected | | 10.10 maverick | Not affected | | 10.04 LTS lucid | Fixed 2.6.32-22.35 | | 9.10 karmic | Fixed 2.6.31-22.60 | | 9.04 jaunty | Fixed 2.6.28-19.61 | | 8.10 intrepid | Ignored end of life, was needed | | 8.04 LTS hardy | Fixed 2.6.24-28.70 | | 6.06 LTS dapper | Not in release | | linux-ec2 | 11.04 natty | Not in release | | 10.10 maverick | Ignored end of life | | 10.04 LTS lucid | Fixed 2.6.32-22.35 | | 9.10 karmic | Fixed 2.6.31-307.15 | | 9.04 jaunty | Not in release | | 8.10 intrepid | Not in release | | 8.04 LTS hardy | Not in release | | 6.06 LTS dapper | Not in release | | linux-fsl-imx51 | 11.04 natty | Not in release | | 10.10 maverick | Not in release | | 10.04 LTS lucid | Fixed 2.6.31-608.14 | | 9.10 karmic | Fixed 2.6.31-112.28 | | 8.04 LTS hardy | Not in release | | 6.06 LTS dapper | Not in release | | linux-lts-backport-maverick | 11.04 natty | Not in release | | 10.10 maverick | Not in release | | 10.04 LTS lucid | Not affected | | 9.10 karmic | Not in release | | 9.04 jaunty | Not in release | | 8.10 intrepid | Not in release | | 8.04 LTS hardy | Not in release | | 6.06 LTS dapper | Not in release | | linux-mvl-dove | 11.04 natty | Not in release | | 10.10 maverick | Not affected | | 10.04 LTS lucid | Fixed 2.6.32-205.18 | | 9.10 karmic | Fixed 2.6.31-214.28 | | 8.04 LTS hardy | Not in release | | 6.06 LTS dapper | Not in release | | linux-source-2.6.15 | 11.04 natty | Not in release | | 10.10 maverick | Not in release | | 10.04 LTS lucid | Not in release | | 9.10 karmic | Not in release | | 9.04 jaunty | Not in release | | 8.10 intrepid | Not in release | | 8.04 LTS hardy | Not in release | | 6.06 LTS dapper | Not affected | | linux-ti-omap4 | 11.04 natty | Not affected | | 10.10 maverick | Not affected | | 10.04 LTS lucid | Not in release | | 9.10 karmic | Not in release | | 8.04 LTS hardy | Not in release | | 6.06 LTS dapper | Not in release | --- * [How can I get the fixes?](https://ubuntu.com/security/cves/about#security) * [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses) ## Notes --- ### [kees](https://launchpad.net/~kees) access to IO/MMIO requires elevated privileges, which already allows for guest OS disruption. No working upstream solution yet. ## References * [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0306) * [NVD](https://nvd.nist.gov/vuln/detail/CVE-2010-0306) * [Launchpad](https://launchpad.net/bugs/cve/CVE-2010-0306) * [Debian](https://security-tracker.debian.org/tracker/CVE-2010-0306) ### Related Ubuntu Security Notices (USN) + [USN-947-1](https://usn.ubuntu.com/USN-947-1) + Linux kernel vulnerabilities + 3 June 2010 ### Other references *