Skip to Content.
Sympa Menu

sm-security - [SM-Security] [SMGLSA-2008-02] kvm local vulnerabilities CVE-2007-1320 and CVE-2008-2004

sm-security AT lists.ibiblio.org

Subject: Security bugs are reported here via bugzilla

List archive

Chronological Thread  
  • From: Eric Sandall <eric AT sandall.us>
  • To: SM-Security <sm-security AT lists.ibiblio.org>
  • Subject: [SM-Security] [SMGLSA-2008-02] kvm local vulnerabilities CVE-2007-1320 and CVE-2008-2004
  • Date: Fri, 23 May 2008 17:49:14 +0000

Synopsis
========
Two vulnerabilities allow local users to execute arbitrary code (CVE-2007-1320
[1]) and allow local guest users to read arbitrary files (CVE-2008-2004[2])
through kvm.

Background
==========
KVM (for Kernel-based Virtual Machine) is a full virtualization solution for
Linux on x86 hardware containing virtualization extensions (Intel VT or
AMD-V).
It consists of a loadable kernel module, kvm.ko, that provides the core
virtualization infrastructure and a processor specific module, kvm-intel.ko
or kvm-amd.ko. KVM also requires a modified QEMU although work is underway to
get the required changes upstream.

Using KVM, one can run multiple virtual machines running unmodified Linux or
Windows images. Each virtual machine has private virtualized hardware: a
network card, disk, graphics adapter, etc.

Description
===========
CVE-2007-1320:
Multiple heap-based buffer overflows in the cirrus_invalidate_region function
in the Cirrus VGA extension in QEMU 0.8.2, as used in Xen and possibly other
products, might allow local users to execute arbitrary code via unspecified
vectors related to "attempting to mark non-existent regions as dirty," aka
the "bitblt" heap overflow.

CVE-2008-2004:
The drive_init function in QEMU 0.9.1 determines the format of a raw disk
image based on the header, which allows local guest users to read arbitrary
files on the host by modifying the header to identify a different format,
which is used when the guest is restarted.

Affected packages
=================
These vulnerabilities were reported for all versions of kvm prior to 69. kvm
in all grimoires is affected by this vulnerability.

This is now fixed in test, and will soon be in the stable grimoire.

Resolution
==========
All firefox users should upgrade to the latest available version:
# scribe update
# cast -c kvm

If you maintain your own installation of kvm ouside of sorcery, there are
patches available from upstream, please visit the kvm 69 release page[0] for
information.

References
==========
[0]
http://sourceforge.net/project/shownotes.php?group_id=180599&release_id=600309
[1] http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-1320
[2] http://nvd.nist.gov/nvd.cfm?cvename=CVE-2008-2004

--
Eric Sandall | Source Mage GNU/Linux Developer
eric AT sandall.us PGP: 0xA8EFDD61 | http://www.sourcemage.org/
http://eric.sandall.us/ | http://counter.li.org/ #196285

Attachment: signature.asc
Description: This is a digitally signed message part.



  • [SM-Security] [SMGLSA-2008-02] kvm local vulnerabilities CVE-2007-1320 and CVE-2008-2004, Eric Sandall, 05/24/2008

Archive powered by MHonArc 2.6.24.

Top of Page