CVE-2014-8134

Published: 8 December 2014

The paravirt_ops_setup function in arch/x86/kernel/kvm.c in the Linux kernel through 3.18 uses an improper paravirt_enabled setting for KVM guest kernels, which makes it easier for guest OS users to bypass the ASLR protection mechanism via a crafted application that reads a 16-bit value.

From the Ubuntu security team

An information leak in the Linux kernel was discovered that could leak the high 16 bits of the kernel stack address on 32-bit Kernel Virtual Machine (KVM) paravirt guests. A user in the guest OS could exploit this leak to obtain information that could potentially be used to aid in attacking the kernel.

Priority

High

CVSS 3 base score: 3.3

Status

Notes

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.04 preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8134
• https://ubuntu.com/security/notices/USN-2441-1
• https://ubuntu.com/security/notices/USN-2442-1
• https://ubuntu.com/security/notices/USN-2443-1
• https://ubuntu.com/security/notices/USN-2444-1
• https://ubuntu.com/security/notices/USN-2445-1
• https://ubuntu.com/security/notices/USN-2446-1
• https://ubuntu.com/security/notices/USN-2447-1
• https://ubuntu.com/security/notices/USN-2448-1
• https://ubuntu.com/security/notices/USN-2464-1
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1400314