NetSight
IP …
medium5.5

CVE-2014-3690

arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.17.2 on Intel processors does not ensure that the value in the CR4 control register remain…

Impact

arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.17.2 on Intel processors does not ensure that the value in the CR4 control register remains the same after a VM entry, which allows host OS users to kill arbitrary processes or cause a denial of service (system disruption) by leveraging /dev/kvm access, as demonstrated by PR_SET_TSC prctl calls within a modified copy of QEMU.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
before 3.17.2
NovellSuse Linux Enterprise Desktop
Version 12.0
NovellSuse Linux Enterprise Server
Versions 11, 12.0
OpensuseEvergreen
Version 11.4
SuseLinux Enterprise Real Time Extension
Version 11
SuseLinux Enterprise Software Development Kit
Version 12
SuseLinux Enterprise Workstation Extension
Version 12
RedhatEnterprise Linux
Version 5.0
DebianDebian Linux
Version 7.0
CanonicalUbuntu Linux
Versions 12.04, 14.04, 14.10

Weakness classification

CWE-400

References