Impact: Important Public Date: 2019-09-17 CWE: CWE-787 Bugzilla: 1746708: CVE-2019-14821 Kernel: KVM: OOB memory access via mmio ring buffer An out-of-bounds access issue was found in the way Linux kernel's KVM hypervisor implements the Coalesced MMIO write operation. It operates on an MMIO ring buffer 'struct kvm_coalesced_mmio' object, wherein write indices 'ring->first' and 'ring->last' value could be supplied by a host user-space process. An unprivileged host user or process with access to '/dev/kvm' device could use this flaw to crash the host kernel, resulting in a denial of service or potentially escalating privileges on the system.
Find out more about CVE-2019-14821 from the MITRE CVE dictionary dictionary and NIST NVD.
This issue does not affect the versions of Linux kernel as shipped with Red Hat Enterprise MRG 2.
This issue affects the version of the kernel package as shipped with Red Hat Enterprise Linux 6, 7 and 8. Future kernel updates for Red Hat Enterprise Linux 6 7, and 8 may address this issue.
Red Hat Enterprise Linux 5 is now in Maintenance Support 2 Phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/
NOTE: The following CVSS v3 metrics and score provided are preliminary and subject to review.
| CVSS3 Base Score | 7.5 |
|---|---|
| CVSS3 Base Metrics | CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:N/I:H/A:H |
| Attack Vector | Local |
| Attack Complexity | High |
| Privileges Required | Low |
| User Interaction | None |
| Scope | Changed |
| Confidentiality | None |
| Integrity Impact | High |
| Availability Impact | High |
| Platform | Package | State |
|---|---|---|
| Red Hat Enterprise MRG 2 | kernel-rt | Not affected |
| Red Hat Enterprise Linux 8 | kernel | Affected |
| Red Hat Enterprise Linux 8 | kernel-rt | Affected |
| Red Hat Enterprise Linux 7 | kernel-alt | Affected |
| Red Hat Enterprise Linux 7 | kernel | Affected |
| Red Hat Enterprise Linux 7 | kernel-rt | Affected |
| Red Hat Enterprise Linux 6 | kernel | Affected |
| Red Hat Enterprise Linux 5 | kernel | Out of support scope |
Vulmon