Security restrictions bypass in Linux kernel - CVE-2012-2121

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU92812

Security restrictions bypass in Linux kernel - CVE-2012-2121

Published: May 17, 2012 / Updated: January 5, 2018


Vulnerability identifier: #VU92812
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2012-2121
CWE-ID: CWE-264
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The KVM implementation in the Linux kernel before 3.3.4 does not properly manage the relationships between memory slots and the iommu, which allows guest OS users to cause a denial of service (memory leak and host OS crash) by leveraging administrative access to the guest OS to conduct hotunplug and hotplug operations on devices.


Affected software

Linux kernel
Ubuntu
linux (Ubuntu package)
linux-lts-backport-natty (Ubuntu package)
linux-lts-backport-oneiric (Ubuntu package)

How to mitigate CVE-2012-2121

Install update from vendor's repository.

linux (Ubuntu package) - addressed in versions 2.6.32-54.116, 2.6.38-15.60, 3.0.0-21.35, 3.2.0-25.40
linux-lts-backport-natty (Ubuntu package) - update to 2.6.38-15.60~lucid1
linux-lts-backport-oneiric (Ubuntu package) - update to 3.0.0-21.35~lucid1

External References

Related Security Bulletins