PT-2009-6214 · Linux+1 · Linux Kernel+1

Eugene Teo · Published 2009-11-27 · Updated 2023-02-13 · CVE-2009-4031

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 2.6.32-rc8-next-20091125

Description The issue is related to the x86 emulator in the KVM subsystem of the Linux kernel. It allows guest OS users to cause a denial of service, specifically increased scheduling latency, on the host OS. This is achieved through manipulations related to SMP support, where the do insn fetch function attempts to interpret instructions with too many bytes to be valid.

Recommendations For Linux kernel versions prior to 2.6.32-rc8-next-20091125, update to version 2.6.32-rc8-next-20091125 or later to resolve the issue.

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2009-4031

DSA-1962-1

RHSA-2009:1659

RHSA-2009:1692

RHSA-2009_1659

Affected Products

Linux Kernel

Red Hat

References · 13

• https://redhat.com/archives/fedora-package-announce/2009-December/msg00777.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-4031 · Security Note
• http://kernel.org/pub/linux/kernel/v2.6/next/patch-v2.6.32-rc8-next-20091125.gz · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2010-03/msg00006.html · Vendor Advisory
• http://securityfocus.com/bid/37130 · Note
• http://openwall.com/lists/oss-security/2009/11/25/3 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=541160 · Note
• https://access.redhat.com/errata/RHSA-2009:1659 · Note
• https://access.redhat.com/security/cve/CVE-2009-4031 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11089 · Note
• http://openwall.com/lists/oss-security/2009/11/25/1 · Note
• http://git.kernel.org/?p=linux/kernel/git/avi/kvm.git%3Ba=commit%3Bh=e42d9b8141d1f54ff72ad3850bb110c95a5f3b88 · Note
• http://secunia.com/advisories/37720 · Note