CVE-2019-7221

Published: 21 March 2019

The KVM implementation in the Linux kernel through 4.20.5 has a Use-after-Free.

From the Ubuntu Security Team

Jim Mattson and Felix Wilhelm discovered a use-after-free vulnerability in the KVM subsystem of the Linux kernel, when using nested virtual machines. A local attacker in a guest VM could use this to cause a denial of service (system crash) or possibly execute arbitrary code in the host system.

Notes

Ubuntu kernels do not enable nested KVM virtualization by default and
are unaffected by this flaw in the default configuration. However, installing
QEMU results in nested KVM support to be enabled via the
/etc/modprobe.d/qemu-system-x86.conf file. To ensure that nested
virtualization is not enabled, verify that the
/sys/module/kvm_intel/parameters/nested file contains "N".

Status

Severity score breakdown

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7221
• https://ubuntu.com/security/notices/USN-3930-1
• https://ubuntu.com/security/notices/USN-3930-2
• https://ubuntu.com/security/notices/USN-3931-1
• https://ubuntu.com/security/notices/USN-3931-2
• https://ubuntu.com/security/notices/USN-3932-1
• https://ubuntu.com/security/notices/USN-3932-2
• NVD
• Launchpad
• Debian

Bugs

• https://bugs.chromium.org/p/project-zero/issues/detail?id=1760