CVE-2013-1796: linux linux_kernel

Vulnerability summary

CVE-2013-1796 is a medium (CVSS 6.8) vulnerability in linux linux_kernel. EPSS estimates a 0.95% chance of exploitation in the next 30 days, higher than 61.1% of scored vulnerabilities.

Timeline

1. 22-03-2013
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

The kvm_set_msr_common function in arch/x86/kvm/x86.c in the Linux kernel through 3.8.4 does not ensure a required time_page alignment during an MSR_KVM_SYSTEM_TIME operation, which allows guest OS users to cause a denial of service (buffer overflow and host OS memory corruption) or possibly have unspecified other impact via a crafted application.

• CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.