CVE-2014-8134

Advisory lineage Upstream: 0 Downstream: 11
Modified
Published: 12 Dec 2014, 18:00
Last modified:06 Aug 2024, 13:10

Vulnerability Summary

Overall Risk (default)
low
23/100
CVSS Score
3.3 LOW
v3.1 (nvd)
EPSS Score
0.09% LOW
0% probability +0.01%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

12 Dec 2014, 18:00
Published
Vulnerability first disclosed
06 Aug 2024, 13:10
Last Modified
Vulnerability information updated

Description

The paravirt_ops_setup function in arch/x86/kernel/kvm.c in the Linux kernel through 3.18 uses an improper paravirt_enabled setting for KVM guest kernels, which makes it easier for guest OS users to bypass the ASLR protection mechanism via a crafted application that reads a 16-bit value.

CVSS Metrics

  • v3.1•LOW•Score: 3.3CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
  • v2.0•LOW•Score: 1.9AV:L/AC:M/Au:N/C:P/I:N/A:N

EPSS Trends

Current EPSS score: 0.09%• Percentile: 25%

Affected Systems

  • canonical•ubuntu_linux

    12.04 | 14.04 | 16.04

  • linux•linux_kernel

    ≤ 3.18

  • opensuse•evergreen

    11.4

  • opensuse•opensuse

    13.1

  • oracle•linux

    6

  • suse•suse_linux_enterprise_server

    11:sp2

References (15)