Rapid7 Vulnerability & Exploit Database

RHSA-2014:0163: kvm security update

Back to Search

RHSA-2014:0163: kvm security update

Severity
6
CVSS
(AV:L/AC:H/Au:N/C:C/I:C/A:C)
Published
12/14/2013
Created
07/25/2018
Added
02/13/2014
Modified
07/04/2017

Description

KVM (Kernel-based Virtual Machine) is a full virtualization solution forLinux on AMD64 and Intel 64 systems. KVM is a Linux kernel module built forthe standard Red Hat Enterprise Linux kernel.A divide-by-zero flaw was found in the apic_get_tmcct() function in KVM'sLocal Advanced Programmable Interrupt Controller (LAPIC) implementation.A privileged guest user could use this flaw to crash the host.(CVE-2013-6367)A memory corruption flaw was discovered in the way KVM handled virtual APICaccesses that crossed a page boundary. A local, unprivileged user could usethis flaw to crash the system or, potentially, escalate their privileges onthe system. (CVE-2013-6368)Red Hat would like to thank Andrew Honig of Google for reporting theseissues.All kvm users are advised to upgrade to these updated packages, whichcontain backported patches to correct these issues. Note: the procedure inthe Solution section must be performed before this update will take effect.

Solution(s)

  • redhat-upgrade-kmod-kvm
  • redhat-upgrade-kmod-kvm-debug
  • redhat-upgrade-kvm
  • redhat-upgrade-kvm-debuginfo
  • redhat-upgrade-kvm-qemu-img
  • redhat-upgrade-kvm-tools

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;