CVE-2010-0435

Published: 24 August 2010

The Hypervisor (aka rhev-hypervisor) in Red Hat Enterprise Virtualization (RHEV) 2.2, and KVM 83, when the Intel VT-x extension is enabled, allows guest OS users to cause a denial of service (NULL pointer dereference and host OS crash) via vectors related to instruction emulation.

From the Ubuntu Security Team

Gleb Napatov discovered that KVM did not correctly check certain privileged operations. A local attacker with access to a guest kernel could exploit this to crash the host system, leading to a denial of service.

Notes

guest can crash host

Looking at the redhat bugzilla it says: "If emulator is tricked into
emulating mov to/from DR instruction it causes NULL pointer dereference
on VMX since kvm_x86_ops->(set|get)_dr are not initialized."
Now before v2.6.36-rc1 KVM has no ops->(set|get)_dr but calls the
function directly. So that Oops cannot happen.

but a fix was included for Lucid anyway?

It was by upstream. Now pulled that change back to Hardy and Karmic.
I believe the reference in the backport is pointing to upstream
commit 020df0794f5764e742feaa718be88b8f1b4ce04f which was part of
2.6.35-rc1

Status

References

• https://ubuntu.com/security/notices/USN-1054-1
• https://ubuntu.com/security/notices/USN-1072-1
• https://ubuntu.com/security/notices/USN-1073-1
• https://ubuntu.com/security/notices/USN-1083-1
• https://www.cve.org/CVERecord?id=CVE-2010-0435
• NVD
• Launchpad
• Debian