CVE-2014-8369

Published: 10 November 2014

The kvm_iommu_map_pages function in virt/kvm/iommu.c in the Linux kernel through 3.17.2 miscalculates the number of pages during the handling of a mapping failure, which allows guest OS users to cause a denial of service (host OS page unpinning) or possibly have unspecified other impact by leveraging guest OS privileges. NOTE: this vulnerability exists because of an incorrect fix for CVE-2014-3601.

From the Ubuntu Security Team

The KVM (kernel virtual machine) subsystem of the Linux kernel miscalculates the number of memory pages during the handling of a mapping failure. A guest OS user could exploit this to cause a denial of service (host OS page unpinning) or possibly have unspecified other impact by leveraging guest OS privileges.

Notes

Author	Note
jdstrand	android kernels (flo, goldfish, grouper, maguro, mako and manta) are not supported on the Ubuntu Touch 14.04 preview kernels linux-lts-saucy no longer receives official support linux-lts-quantal no longer receives official support

Author

Note

jdstrand

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.04 preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

Priority

Cvss 3 Severity Score

7.8

Score breakdown

Status

Package	Release	Status
linux Launchpad, Ubuntu, Debian	lucid	Not vulnerable
	precise	Released (3.2.0-75.110)
	trusty	Released (3.13.0-41.70)
	upstream	Released (3.18~rc2)
	utopic	Released (3.16.0-26.35)
	vivid	Not vulnerable (3.16.0-28.38)
	wily	Not vulnerable (3.19.0-15.15)
	Patches: Introduced by 350b8bdd689cd2ab2c67c8a86a0be86cfa0751a7 Fixed by 3d32e4dbe71374a6780eaf51d719d76f9a9bf22f
linux-armadaxp Launchpad, Ubuntu, Debian	lucid	Does not exist
	precise	Released (3.2.0-1643.62)
	trusty	Does not exist
	upstream	Released (3.18~rc2)
	utopic	Does not exist
	vivid	Does not exist
	wily	Does not exist
	This package is not directly supported by the Ubuntu Security Team
linux-ec2 Launchpad, Ubuntu, Debian	lucid	Not vulnerable
	precise	Does not exist
	trusty	Does not exist
	upstream	Released (3.18~rc2)
	utopic	Does not exist
	vivid	Does not exist
	wily	Does not exist
linux-flo Launchpad, Ubuntu, Debian	lucid	Does not exist
	precise	Does not exist
	trusty	Does not exist (trusty was ignored)
	upstream	Released (3.18~rc2)
	utopic	Not vulnerable
	vivid	Not vulnerable
	wily	Not vulnerable
linux-fsl-imx51 Launchpad, Ubuntu, Debian	lucid	Ignored (end of life)
	precise	Does not exist
	trusty	Does not exist
	upstream	Released (3.18~rc2)
	utopic	Does not exist
	vivid	Does not exist
	wily	Does not exist
linux-goldfish Launchpad, Ubuntu, Debian	lucid	Does not exist
	precise	Does not exist
	trusty	Does not exist (trusty was ignored)
	upstream	Released (3.18~rc2)
	utopic	Not vulnerable
	vivid	Not vulnerable
	wily	Not vulnerable
linux-grouper Launchpad, Ubuntu, Debian	lucid	Does not exist
	precise	Does not exist
	trusty	Does not exist (trusty was ignored)
	upstream	Released (3.18~rc2)
	utopic	Ignored (end of life)
	vivid	Does not exist
	wily	Does not exist
linux-linaro-omap Launchpad, Ubuntu, Debian	lucid	Does not exist
	precise	Ignored (end of life)
	trusty	Does not exist
	upstream	Released (3.18~rc2)
	utopic	Does not exist
	vivid	Does not exist
	wily	Does not exist
linux-linaro-shared Launchpad, Ubuntu, Debian	lucid	Does not exist
	precise	Ignored (end of life)
	trusty	Does not exist
	upstream	Released (3.18~rc2)
	utopic	Does not exist
	vivid	Does not exist
	wily	Does not exist
linux-linaro-vexpress Launchpad, Ubuntu, Debian	lucid	Does not exist
	precise	Ignored (end of life)
	trusty	Does not exist
	upstream	Released (3.18~rc2)
	utopic	Does not exist
	vivid	Does not exist
	wily	Does not exist
linux-lts-quantal Launchpad, Ubuntu, Debian	lucid	Does not exist
	precise	Ignored (end of life, was pending)
	trusty	Does not exist
	upstream	Released (3.18~rc2)
	utopic	Does not exist
	vivid	Does not exist
	wily	Does not exist
	This package is not directly supported by the Ubuntu Security Team
linux-lts-raring Launchpad, Ubuntu, Debian	lucid	Does not exist
	precise	Ignored (end of life, was needs-triage)
	trusty	Does not exist
	upstream	Released (3.18~rc2)
	utopic	Does not exist
	vivid	Does not exist
	wily	Does not exist
linux-lts-saucy Launchpad, Ubuntu, Debian	lucid	Does not exist
	precise	Ignored (end of life, was pending)
	trusty	Does not exist
	upstream	Released (3.18~rc2)
	utopic	Does not exist
	vivid	Does not exist
	wily	Does not exist
	This package is not directly supported by the Ubuntu Security Team
linux-lts-trusty Launchpad, Ubuntu, Debian	lucid	Does not exist
	precise	Released (3.13.0-41.70~precise1)
	trusty	Does not exist
	upstream	Released (3.18~rc2)
	utopic	Does not exist
	vivid	Does not exist
	wily	Does not exist
linux-lts-utopic Launchpad, Ubuntu, Debian	lucid	Does not exist
	precise	Does not exist
	trusty	Released (3.16.0-26.35~14.04.1)
	upstream	Released (3.18~rc2)
	utopic	Does not exist
	vivid	Does not exist
	wily	Does not exist
linux-lts-vivid Launchpad, Ubuntu, Debian	lucid	Does not exist
	precise	Does not exist
	trusty	Does not exist (trusty was not-affected [3.19.0-18.18~14.04.1])
	upstream	Released (3.18~rc2)
	utopic	Does not exist
	vivid	Does not exist
	wily	Does not exist
linux-maguro Launchpad, Ubuntu, Debian	lucid	Does not exist
	precise	Does not exist
	trusty	Does not exist (trusty was ignored)
	upstream	Released (3.18~rc2)
	utopic	Does not exist
	vivid	Does not exist
	wily	Does not exist
linux-mako Launchpad, Ubuntu, Debian	lucid	Does not exist
	precise	Does not exist
	trusty	Does not exist (trusty was ignored)
	upstream	Released (3.18~rc2)
	utopic	Not vulnerable
	vivid	Not vulnerable
	wily	Not vulnerable
linux-manta Launchpad, Ubuntu, Debian	lucid	Does not exist
	precise	Does not exist
	trusty	Does not exist (trusty was ignored)
	upstream	Released (3.18~rc2)
	utopic	Not vulnerable
	vivid	Not vulnerable
	wily	Not vulnerable
linux-mvl-dove Launchpad, Ubuntu, Debian	lucid	Ignored (end of life)
	precise	Does not exist
	trusty	Does not exist
	upstream	Released (3.18~rc2)
	utopic	Does not exist
	vivid	Does not exist
	wily	Does not exist
linux-qcm-msm Launchpad, Ubuntu, Debian	lucid	Ignored (end of life)
	precise	Ignored (end of life)
	trusty	Does not exist
	upstream	Released (3.18~rc2)
	utopic	Does not exist
	vivid	Does not exist
	wily	Does not exist
linux-raspi2 Launchpad, Ubuntu, Debian	precise	Does not exist
	trusty	Does not exist
	upstream	Released (3.18~rc2)
	vivid	Does not exist
	wily	Not vulnerable (4.2.0-1008.12)
linux-ti-omap4 Launchpad, Ubuntu, Debian	lucid	Does not exist
	precise	Released (3.2.0-1458.78)
	trusty	Does not exist
	upstream	Released (3.18~rc2)
	utopic	Does not exist
	vivid	Does not exist
	wily	Does not exist

Severity score breakdown

Parameter	Value
Base score	7.8
Attack vector	Local
Attack complexity	Low
Privileges required	Low
User interaction	None
Scope	Unchanged
Confidentiality	High
Integrity impact	High
Availability impact	High
Vector	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Bugs

https://launchpad.net/bugs/1386395

Join the discussion

Canonical is offering Expanded Security Maintenance

Canonical is offering Ubuntu Expanded Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›