#VU43920 Input validation error in Linux kernel - CVE-2012-0045

Vulnerability identifier: #VU43920

Vulnerability risk: Medium

CVSSv4.0: 5.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/U:Green]

CVE-ID: CVE-2012-0045

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: Yes

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The em_syscall function in arch/x86/kvm/emulate.c in the KVM implementation in the Linux kernel before 3.2.14 does not properly handle the 0f05 (aka syscall) opcode, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application, as demonstrated by an NASM file.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: 3.0 - 3.0.34, 3.1 - 3.1.10, 3.2 - 3.2.12

---

External links
https://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=c2226fc9e87ba3da060e47333657cd6616652b84
https://lists.opensuse.org/opensuse-security-announce/2012-05/msg00013.html
https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.14
https://www.openwall.com/lists/oss-security/2012/01/12/2
https://bugzilla.redhat.com/show_bug.cgi?id=773370
https://github.com/torvalds/linux/commit/c2226fc9e87ba3da060e47333657cd6616652b84

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.