PT-2013-3478 · Linux+2 · Kvm+2

Published 2013-06-10 · Updated 2019-04-22 · CVE-2013-1935

Positive Technologies (AI Summary)

CVSS v2.0

5.7

Medium

Base vector

AV:A/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Red Hat Enterprise Linux (RHEL) 6 kernel package versions prior to 2.6.32-358.11.1.el6

Description The issue is related to a certain Red Hat patch to the KVM subsystem in the kernel package, which does not properly implement the PV EOI feature. This allows guest OS users to cause a denial of service by leveraging a time window during which interrupts are disabled but copy to user function calls are possible, resulting in a host OS crash.

Recommendations For Red Hat Enterprise Linux (RHEL) 6 kernel package versions prior to 2.6.32-358.11.1.el6, update to version 2.6.32-358.11.1.el6 or later to resolve the issue.

Fix

DoS

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CESA-2013_0911

CVE-2013-1935

RHSA-2013:0907

RHSA-2013:0911

RHSA-2013_0911

Affected Products

Centos

Kvm

Red Hat

References · 19

• https://linux.oracle.com/errata/ELSA-2013-0911.html · Vendor Advisory
• https://rhn.redhat.com/errata/RHSA-2013-0907.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2188 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1935 · Security Note
• http://rhn.redhat.com/errata/RHSA-2013-0911.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-1935 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2017 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1943 · Security Note
• https://access.redhat.com/security/cve/CVE-2013-1935 · Note
• https://lists.centos.org/pipermail/centos-announce/2013-June/081946.html · Note
• https://lists.centos.org/pipermail/centos-announce/2013-June/031822.html · Note
• https://access.redhat.com/security/cve/CVE-2013-2188 · Note
• https://lists.centos.org/pipermail/centos-announce/2013-June/056703.html · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=949981 · Note
• https://access.redhat.com/errata/RHSA-2013:0911 · Note