PT-2010-2090 · Linux+1 · Kvm+1

Eugene Teo + 1 · Published 2010-02-09 · Updated 2024-06-27 · CVE-2010-0298

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions KVM version 83

Description The issue concerns the x86 emulator in KVM, which fails to properly use the Current Privilege Level (CPL) and I/O Privilege Level (IOPL) when determining memory access for CPL3 code. This allows users of the guest OS to potentially cause a denial of service, resulting in a guest OS crash, or gain privileges on the guest OS. The exploitation can occur through access to either an IO port or an MMIO region.

Recommendations For KVM version 83, update to a version that includes the necessary fixes to properly handle CPL and IOPL for memory access.

Fix

DoS

Weakness Enumeration

CWE-264

Related Identifiers

AZL-6514

CVE-2010-0298

DSA-1996-1

DSA-2010-1

RHSA-2010:0088

RHSA-2010:0095

RHSA-2010_0088

Affected Products

Kvm

Red Hat

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2010-0298 · Security Note
• https://rhn.redhat.com/errata/RHSA-2010-0088.html · Vendor Advisory
• http://debian.org/security/2010/dsa-1996 · Vendor Advisory
• https://rhn.redhat.com/errata/RHSA-2010-0095.html · Vendor Advisory
• https://osv.dev/vulnerability/AZL-6514 · Vendor Advisory
• https://t.me/cvenotify/84754 · Telegram Post
• https://bugzilla.redhat.com/show_bug.cgi?id=559091 · Note
• http://secunia.com/advisories/38492 · Note
• http://securityfocus.com/bid/38158 · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11335 · Note