CVE-2014-7842

Published: 29 November 2014

Race condition in arch/x86/kvm/x86.c in the Linux kernel before 3.17.4 allows guest OS users to cause a denial of service (guest OS crash) via a crafted application that performs an MMIO transaction or a PIO transaction to trigger a guest userspace emulation error report, a similar issue to CVE-2010-5313.

From the Ubuntu security team

A race condition with MMIO and PIO transactions in the KVM (Kernel Virtual Machine) subsystem of the Linux kernel was discovered. A guest OS user could exploit this flaw to cause a denial of service (guest OS crash) via a specially crafted application.

Notes

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.04 preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-7842
• https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=fc3a9157d314 (v2.6.38-rc1)
• https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a2b9e6c1a35a (v3.18-rc1)
• https://ubuntu.com/security/notices/USN-2464-1
• https://ubuntu.com/security/notices/USN-2465-1
• https://ubuntu.com/security/notices/USN-2466-1
• https://ubuntu.com/security/notices/USN-2467-1
• https://ubuntu.com/security/notices/USN-2468-1
• https://ubuntu.com/security/notices/USN-2463-1
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1392823