505670 – (CVE-2014-0049) Kernel: kvm: mmio_fragments out-of-the-bounds access (CVE-2014-0149)

Bug 505670 (CVE-2014-0049) - Kernel: kvm: mmio_fragments out-of-the-bounds access (CVE-2014-0149)

Summary: Kernel: kvm: mmio_fragments out-of-the-bounds access (CVE-2014-0149)

Status:	RESOLVED FIXED

Alias:	CVE-2014-0049

Product:	Gentoo Security
Classification:	Unclassified
Component:	Kernel (show other bugs)
Hardware:	All Linux

Importance:	Normal normal (vote)
Assignee:	Gentoo Kernel Security

URL:
Whiteboard:
Keywords:

Depends on:
Blocks:

Reported:	2014-03-25 12:03 UTC by Agostino Sarubbo
Modified:	2022-03-25 21:33 UTC (History)
CC List:	1 user (show)

See Also:
Package list:
Runtime testing required:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Agostino Sarubbo gentoo-dev

2014-03-25 12:03:13 UTC

CVE-2014-0149 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0149):

Buffer overflow in the complete_emulated_mmio function in arch/x86/kvm/x86.c in the Linux kernel before 
3.13.6 allows guest OS users to execute arbitrary code on the host OS by leveraging a loop that triggers 
an invalid memory copy affecting certain cancel_work_item data.

Comment 1 John Helmert III archtester

2022-03-25 19:48:24 UTC

Hm, what happened here? The CVE description is now, "Multiple cross-site scripting (XSS) vulnerabilities in Red Hat JBoss Web Framework Kit 2.5.0 allow remote attackers to inject arbitrary web script or HTML via a (1) parameter or (2) id name."

Comment 2 John Helmert III archtester

2022-03-25 21:33:24 UTC

I see what happened (thanks ionen!), the CVE is typo'd.

CVE-2014-0049:

"Buffer overflow in the complete_emulated_mmio function in arch/x86/kvm/x86.c in the Linux kernel before 3.13.6 allows guest OS users to execute arbitrary code on the host OS by leveraging a loop that triggers an invalid memory copy affecting certain cancel_work_item data."

Fix in 3.14, https://github.com/torvalds/linux/commit/a08d3b3b99efd509133946056531cdf8f3a0c09b