CVE-2014-3690

Advisory lineage Upstream: 0 Downstream: 7
Modified
Published: 10 Nov 2014, 11:00
Last modified:06 Aug 2024, 10:50

Vulnerability Summary

Overall Risk (default)
low
22/100
CVSS Score
5.5 MEDIUM
v3.1 (nvd)
EPSS Score
0.04% LOW
0% probability +0.03%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

10 Nov 2014, 11:00
Published
Vulnerability first disclosed
06 Aug 2024, 10:50
Last Modified
Vulnerability information updated

Description

arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.17.2 on Intel processors does not ensure that the value in the CR4 control register remains the same after a VM entry, which allows host OS users to kill arbitrary processes or cause a denial of service (system disruption) by leveraging /dev/kvm access, as demonstrated by PR_SET_TSC prctl calls within a modified copy of QEMU.

CVSS Metrics

  • v3.1•MEDIUM•Score: 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
  • v2.0•MEDIUM•Score: 4.9AV:L/AC:L/Au:N/C:N/I:N/A:C

EPSS Trends

Current EPSS score: 0.04%• Percentile: 12%

Techniques & Countermeasures

  • CWE-400•Uncontrolled Resource Consumption

    The product does not properly control the allocation and maintenance of a limited resource.

Affected Systems

  • canonical•ubuntu_linux

    12.04 | 14.04 | 14.10

  • debian•debian_linux

    7.0

  • linux•linux_kernel

    < 3.17.2

  • novell•suse_linux_enterprise_desktop

    12.0

  • novell•suse_linux_enterprise_server

    11:sp2 | 12.0

  • opensuse•evergreen

    11.4

  • redhat•enterprise_linux

    5.0

  • suse•linux_enterprise_real_time_extension

    11:sp3

  • suse•linux_enterprise_software_development_kit

    12

  • suse•linux_enterprise_workstation_extension

    12

References (22)