PT-2019-4107 · Qemu+7 · Qemu-Kvm+7
Peter Pi
·
Published
2014-10-23
·
Updated
2023-12-15
·
CVE-2019-14835
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions 2.6.34 through 5.2.x
Description
A buffer overflow flaw was found in the Linux kernel's vhost functionality, which translates virtqueue buffers to IOVs and logs buffer descriptors during migration. This flaw can be exploited by a privileged guest user who can pass descriptors with invalid length to the host during migration, potentially increasing their privileges on the host. The issue is related to the vhost-net module, which is a network backend for virtio, and can be used to bypass isolation in systems based on QEMU-KVM.
Recommendations
For Linux kernel versions 2.6.34 through 5.2.x, consider disabling the vhost functionality or restricting access to it until a patch is available. As a temporary workaround, avoid using the vhost-net module during virtual machine migration. There is no information about a newer version that contains a fix for this vulnerability.
Exploit
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Centos
Huawei Vrp
Linux Kernel
Qemu-Kvm
Red Hat
Suse
Ubuntu