Bug 434872 (CVE-2012-3221) – <app-emulation/virtualbox{,-bin}-4.1.22 : Missing VT-x / AMD-V Extension Interrupt Handling Vulnerability (CVE-2012-3221)

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description Agostino Sarubbo 2012-09-13 09:18:42 UTC]

From secunia at $URL:

Description
halfdog has reported a vulnerability in Oracle VirtualBox, which can be exploited by malicious, local users in a guest virtual machine to cause a DoS (Denial of Service).

The vulnerability is caused due to a NULL-pointer dereference error when calling the task-gate via IDT (software interrupt) with insufficient privileges in a processor missing VT-x / AMD-V extensions and can be exploited to cause a crash.

The vulnerability is reported in versions prior to 4.1.22.


Solution
Update to version 4.1.22.

[Comment 1 Lars Wendler (Polynomial-C) (RETIRED) 2012-09-13 10:25:03 UTC]

Arches please test and mark stable the following packages:

=app-emulation/virtualbox-4.1.22
=app-emulation/virtualbox-additions-4.1.22
=app-emulation/virtualbox-bin-4.1.22
=app-emulation/virtualbox-extpack-oracle-4.1.22
=app-emulation/virtualbox-guest-additions-4.1.22
=app-emulation/virtualbox-modules-4.1.22
=x11-drivers/xf86-video-virtualbox-4.1.22

Target keywords are:
amd64 x86



Although only app-emulation/virtualbox{,-bin} are affected we need all these packages stable as they are:
  - a dependency of app-emulation/virtualbox{,-bin}
  - need to stay in sync with the rest of the packages

[Comment 2 Richard Freeman 2012-09-14 13:44:22 UTC]

I'm not sure if all need to be kept in sync.  For amd64 I've tested and can stabilize:

=app-emulation/virtualbox-bin-4.1.22
=app-emulation/virtualbox-guest-additions-4.1.22
=app-emulation/virtualbox-modules-4.1.22

[Comment 3 Maurizio Camisaschi (amd64 AT) 2012-09-16 13:34:01 UTC]

(In reply to comment #1)
> =app-emulation/virtualbox-4.1.22
> =app-emulation/virtualbox-additions-4.1.22
> =app-emulation/virtualbox-bin-4.1.22
> =app-emulation/virtualbox-extpack-oracle-4.1.22
> =app-emulation/virtualbox-guest-additions-4.1.22
> =app-emulation/virtualbox-modules-4.1.22
> =x11-drivers/xf86-video-virtualbox-4.1.22

amd64 ok

[Comment 4 Agostino Sarubbo 2012-09-16 23:37:03 UTC]

amd64 stable, thanks Maurizio and Richard

[Comment 5 Andreas Schürch 2012-09-17 20:18:16 UTC]

x86 done. thanks!
last arch!

[Comment 6 Agostino Sarubbo 2012-09-17 20:19:26 UTC]

security, please vote

[Comment 7 Sean Amoss (RETIRED) 2012-09-19 10:44:58 UTC]

GLSA vote: yes.

[Comment 8 Tim Sammut (RETIRED) 2012-09-20 23:39:22 UTC]

GLSA Vote: yes, too. Request filed.

[Comment 9 GLSAMaker/CVETool Bot 2012-10-20 00:07:31 UTC]

CVE-2012-3221 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-3221):
  Unspecified vulnerability in the Oracle VM Virtual Box component in Oracle
  Virtualization 3.2, 4.0, and 4.1 allows local users to affect availability
  via unknown vectors related to VirtualBox Core.

[Comment 10 GLSAMaker/CVETool Bot 2014-01-20 09:18:12 UTC]

This issue was resolved and addressed in
 GLSA 201401-13 at http://security.gentoo.org/glsa/glsa-201401-13.xml
by GLSA coordinator Sergey Popov (pinkbyte).