CVE-2013-0311 in Ubuntu

CVE-2013-0311

Priority

Medium

Description

The translate_desc function in drivers/vhost/vhost.c in the Linux kernel
before 3.7 does not properly handle cross-region descriptors, which allows
guest OS users to obtain host OS privileges by leveraging KVM guest OS
privileges.

Ubuntu-Description

A flaw was discovered in the Linux kernel's vhost driver used to accelerate
guest networking in KVM based virtual machines. A privileged guest user
could exploit this flaw to crash the host system.

References

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0311
http://www.openwall.com/lists/oss-security/2013/02/19
http://www.ubuntu.com/usn/usn-1756-1
http://www.ubuntu.com/usn/usn-1760-1
http://www.ubuntu.com/usn/usn-1767-1
http://www.ubuntu.com/usn/usn-1768-1
http://www.ubuntu.com/usn/usn-1769-1
http://www.ubuntu.com/usn/usn-1774-1
http://www.ubuntu.com/usn/usn-1778-1
http://www.ubuntu.com/usn/usn-1781-1

Bugs

https://bugzilla.redhat.com/show_bug.cgi?id=912905
https://launchpad.net/bugs/1130951

Notes

apw> this is a bug in the vhost driver which was introduced in this commit:
apw> 3a4d5c94e959359ece6d6b55045c3f046677f55c

Package

Source: linux-armadaxp (LP Ubuntu Debian)

Upstream:	released (3.7~rc8)
Ubuntu 8.04 LTS (Hardy Heron):	DNE
Ubuntu 10.04 LTS (Lucid Lynx):	DNE
Ubuntu 11.10 (Oneiric Ocelot):	DNE
Ubuntu 12.04 LTS (Precise Pangolin):	released (3.2.0-1615.23)
Ubuntu 12.10 (Quantal Quetzal):	released (3.5.0-1610.14)
Ubuntu 13.04 (Raring Ringtail):	DNE

Package

Source: linux-ec2 (LP Ubuntu Debian)

Upstream:	released (3.7~rc8)
Ubuntu 8.04 LTS (Hardy Heron):	DNE
Ubuntu 10.04 LTS (Lucid Lynx):	not-affected
Ubuntu 11.10 (Oneiric Ocelot):	DNE
Ubuntu 12.04 LTS (Precise Pangolin):	DNE
Ubuntu 12.10 (Quantal Quetzal):	DNE
Ubuntu 13.04 (Raring Ringtail):	DNE

Package

Source: linux-lts-backport-oneiric (LP Ubuntu Debian)

Upstream:	released (3.7~rc8)
Ubuntu 8.04 LTS (Hardy Heron):	DNE
Ubuntu 10.04 LTS (Lucid Lynx):	released (3.0.0-32.50~lucid1)
Ubuntu 11.10 (Oneiric Ocelot):	DNE
Ubuntu 12.04 LTS (Precise Pangolin):	DNE
Ubuntu 12.10 (Quantal Quetzal):	DNE
Ubuntu 13.04 (Raring Ringtail):	DNE

Package

Source: linux-linaro-shared (LP Ubuntu Debian)

Upstream:	released (3.7~rc8)
Ubuntu 8.04 LTS (Hardy Heron):	DNE
Ubuntu 10.04 LTS (Lucid Lynx):	DNE
Ubuntu 11.10 (Oneiric Ocelot):	ignored (abandoned)
Ubuntu 12.04 LTS (Precise Pangolin):	ignored (abandoned)
Ubuntu 12.10 (Quantal Quetzal):	ignored (abandoned)
Ubuntu 13.04 (Raring Ringtail):	ignored (abandoned)

Package

Source: linux-linaro-vexpress (LP Ubuntu Debian)

Upstream:	released (3.7~rc8)
Ubuntu 8.04 LTS (Hardy Heron):	DNE
Ubuntu 10.04 LTS (Lucid Lynx):	DNE
Ubuntu 11.10 (Oneiric Ocelot):	ignored (abandoned)
Ubuntu 12.04 LTS (Precise Pangolin):	ignored (abandoned)
Ubuntu 12.10 (Quantal Quetzal):	ignored (abandoned)
Ubuntu 13.04 (Raring Ringtail):	ignored (abandoned)

Package

Source: linux-qcm-msm (LP Ubuntu Debian)

Upstream:	released (3.7~rc8)
Ubuntu 8.04 LTS (Hardy Heron):	DNE
Ubuntu 10.04 LTS (Lucid Lynx):	ignored (abandoned)
Ubuntu 11.10 (Oneiric Ocelot):	ignored (abandoned)
Ubuntu 12.04 LTS (Precise Pangolin):	ignored (abandoned)
Ubuntu 12.10 (Quantal Quetzal):	ignored (abandoned)
Ubuntu 13.04 (Raring Ringtail):	ignored (abandoned)

Package

Source: linux-lts-quantal (LP Ubuntu Debian)

Upstream:	released (3.7~rc8)
Ubuntu 8.04 LTS (Hardy Heron):	DNE
Ubuntu 10.04 LTS (Lucid Lynx):	DNE
Ubuntu 11.10 (Oneiric Ocelot):	DNE
Ubuntu 12.04 LTS (Precise Pangolin):	released (3.5.0-26.40~precise1)
Ubuntu 12.10 (Quantal Quetzal):	DNE
Ubuntu 13.04 (Raring Ringtail):	DNE

Patches:

Package

Source: linux-mvl-dove (LP Ubuntu Debian)

Upstream:	released (3.7~rc8)
Ubuntu 8.04 LTS (Hardy Heron):	DNE
Ubuntu 10.04 LTS (Lucid Lynx):	ignored (reached end-of-life)
Ubuntu 11.10 (Oneiric Ocelot):	DNE
Ubuntu 12.04 LTS (Precise Pangolin):	DNE
Ubuntu 12.10 (Quantal Quetzal):	DNE
Ubuntu 13.04 (Raring Ringtail):	DNE

Package

Source: linux-lts-backport-maverick (LP Ubuntu Debian)

Upstream:	released (3.7~rc8)
Ubuntu 8.04 LTS (Hardy Heron):	DNE
Ubuntu 10.04 LTS (Lucid Lynx):	ignored (reached end-of-life)
Ubuntu 11.10 (Oneiric Ocelot):	DNE
Ubuntu 12.04 LTS (Precise Pangolin):	DNE
Ubuntu 12.10 (Quantal Quetzal):	DNE
Ubuntu 13.04 (Raring Ringtail):	DNE

Package

Source: linux (LP Ubuntu Debian)

Upstream:	released (3.7~rc8)
Ubuntu 8.04 LTS (Hardy Heron):	not-affected
Ubuntu 10.04 LTS (Lucid Lynx):	not-affected
Ubuntu 11.10 (Oneiric Ocelot):	released (3.0.0-32.50)
Ubuntu 12.04 LTS (Precise Pangolin):	released (3.2.0-39.62)
Ubuntu 12.10 (Quantal Quetzal):	released (3.5.0-26.40)
Ubuntu 13.04 (Raring Ringtail):	not-affected (3.7.0-5.13)

Patches:

Introduced by 3a4d5c94e959359ece6d6b55045c3f046677f55c

Fixed by bd97120fc3d1a11f3124c7c9ba1d91f51829eb85

Package

Source: linux-ti-omap4 (LP Ubuntu Debian)

Upstream:	released (3.7~rc8)
Ubuntu 8.04 LTS (Hardy Heron):	DNE
Ubuntu 10.04 LTS (Lucid Lynx):	DNE
Ubuntu 11.10 (Oneiric Ocelot):	released (3.0.0-1222.36)
Ubuntu 12.04 LTS (Precise Pangolin):	released (3.2.0-1427.36)
Ubuntu 12.10 (Quantal Quetzal):	released (3.5.0-221.30)
Ubuntu 13.04 (Raring Ringtail):	not-affected (3.5.0-221.30)

Package

Source: linux-linaro-omap (LP Ubuntu Debian)

Upstream:	released (3.7~rc8)
Ubuntu 8.04 LTS (Hardy Heron):	DNE
Ubuntu 10.04 LTS (Lucid Lynx):	DNE
Ubuntu 11.10 (Oneiric Ocelot):	ignored (abandoned)
Ubuntu 12.04 LTS (Precise Pangolin):	ignored (abandoned)
Ubuntu 12.10 (Quantal Quetzal):	ignored (abandoned)
Ubuntu 13.04 (Raring Ringtail):	ignored (abandoned)

Package

Source: linux-fsl-imx51 (LP Ubuntu Debian)

Upstream:	released (3.7~rc8)
Ubuntu 8.04 LTS (Hardy Heron):	DNE
Ubuntu 10.04 LTS (Lucid Lynx):	ignored (reached end-of-life, does not affect buildd)
Ubuntu 11.10 (Oneiric Ocelot):	DNE
Ubuntu 12.04 LTS (Precise Pangolin):	DNE
Ubuntu 12.10 (Quantal Quetzal):	DNE
Ubuntu 13.04 (Raring Ringtail):	DNE

More Information

Updated: 2013-04-12 19:14:57 UTC (commit 6704)