CVE-2014-8134

Published: 8 December 2014

The paravirt_ops_setup function in arch/x86/kernel/kvm.c in the Linux kernel through 3.18 uses an improper paravirt_enabled setting for KVM guest kernels, which makes it easier for guest OS users to bypass the ASLR protection mechanism via a crafted application that reads a 16-bit value.

From the Ubuntu security team

An information leak in the Linux kernel was discovered that could leak the high 16 bits of the kernel stack address on 32-bit Kernel Virtual Machine (KVM) paravirt guests. A user in the guest OS could exploit this leak to obtain information that could potentially be used to aid in attacking the kernel.

Notes

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.04 preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

Priority

High

CVSS 3 base score: 3.3

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8134
• https://ubuntu.com/security/notices/USN-2441-1
• https://ubuntu.com/security/notices/USN-2442-1
• https://ubuntu.com/security/notices/USN-2443-1
• https://ubuntu.com/security/notices/USN-2444-1
• https://ubuntu.com/security/notices/USN-2445-1
• https://ubuntu.com/security/notices/USN-2446-1
• https://ubuntu.com/security/notices/USN-2447-1
• https://ubuntu.com/security/notices/USN-2448-1
• https://ubuntu.com/security/notices/USN-2464-1
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1400314