The update_cr8_intercept function in arch/x86/kvm/x86.c in the KVM subsystem in the Linux kernel before 2.6.32-rc1 does not properly handle the absence of an Advanced Programmable Interrupt Controller (APIC), which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly gain privileges via a call to the kvm_vcpu_ioctl function.

This update of QEMU KVM fixes the following bugs :

  - use-after-free bug in VNC code which might be used to     execute code on the host system injected from the guest     system. (CVE-2009-3616: CVSS v2 Base Score: 8.5)

  - integer overflow in kvm_dev_ioctl_get_supported_cpuid().
    (CVE-2009-3638: CVSS v2 Base Score: 7.2)

  - update_cr8_intercept() NULL pointer dereference.
    (CVE-2009-3640: CVSS v2 Base Score: 2.1)

This update of QEMU KVM fixes the following bugs :

  - CVE-2009-3616: CVSS v2 Base Score: 8.5 use-after-free     bug in VNC code which might be used to execute code on     the host system injected from the guest system

  - CVE-2009-3638: CVSS v2 Base Score: 7.2 integer overflow     in kvm_dev_ioctl_get_supported_cpuid() 

  - CVE-2009-3640: CVSS v2 Base Score: 2.1     update_cr8_intercept() NULL pointer dereference

ID	Name	Product	Family	Severity
42867	SuSE 11 Security Update : KVM (SAT Patch Number 1553)	Nessus	SuSE Local Security Checks	high
42865	openSUSE Security Update : kvm (kvm-1545)	Nessus	SuSE Local Security Checks	high
42864	openSUSE Security Update : kvm (kvm-1547)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2009-3640

high

Tenable Plugins

high

high

high