CVE-2013-4592

Published: 20 November 2013

Memory leak in the __kvm_set_memory_region function in virt/kvm/kvm_main.c in the Linux kernel before 3.9 allows local users to cause a denial of service (memory consumption) by leveraging certain device access to trigger movement of memory slots.

From the Ubuntu Security Team

A flaw in the handling of memory regions of the kernel virtual machine (KVM) subsystem was discovered. A local user with the ability to assign a device could exploit this flaw to cause a denial of service (memory consumption).

Notes

attacker requires privileged access to the host hardware to exploit
per kernel team, too intrusive to backport

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4592
• https://www.kernel.org/pub/linux/kernel/v3.x/patch-3.9.bz2
• https://github.com/torvalds/linux/commit/e40f193f5bb022e927a57a4f5d5194e4f12ddb74
• https://github.com/torvalds/linux/commit/12d6e7538e2d418c08f082b1b44ffa5fb7270ed8
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e40f193f5bb022e927a57a4f5d5194e4f12ddb74
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=12d6e7538e2d418c08f082b1b44ffa5fb7270ed8
• https://bugzilla.redhat.com/show_bug.cgi?id=1031702
• http://www.openwall.com/lists/oss-security/2013/11/18/3
• https://ubuntu.com/security/notices/USN-2066-1
• https://ubuntu.com/security/notices/USN-2067-1
• https://ubuntu.com/security/notices/USN-2111-1
• https://ubuntu.com/security/notices/USN-2112-1
• https://ubuntu.com/security/notices/USN-2114-1
• https://ubuntu.com/security/notices/USN-2115-1
• https://ubuntu.com/security/notices/USN-2116-1
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1254900