Vulnerability Description
The x86 emulator in KVM 83 does not use the Current Privilege Level (CPL) and I/O Privilege Level (IOPL) in determining the memory access available to CPL3 code, which allows guest OS users to cause a denial of service (guest OS crash) or gain privileges on the guest OS by leveraging access to a (1) IO port or (2) MMIO region, a related issue to CVE-2010-0306.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux Kernel | >= 2.6.28, <= 2.6.33 |
| Debian | Debian Linux | 5.0 |
Related Weaknesses (CWE)
References
- http://secunia.com/advisories/38492Not Applicable
- http://www.debian.org/security/2010/dsa-1996Not ApplicableThird Party Advisory
- http://www.securityfocus.com/bid/38158Broken LinkThird Party AdvisoryVDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=559091Issue Tracking
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Broken Link
- https://rhn.redhat.com/errata/RHSA-2010-0088.htmlThird Party Advisory
- https://rhn.redhat.com/errata/RHSA-2010-0095.htmlThird Party Advisory
- http://secunia.com/advisories/38492Not Applicable
- http://www.debian.org/security/2010/dsa-1996Not ApplicableThird Party Advisory
- http://www.securityfocus.com/bid/38158Broken LinkThird Party AdvisoryVDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=559091Issue Tracking
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Broken Link
- https://rhn.redhat.com/errata/RHSA-2010-0088.htmlThird Party Advisory
- https://rhn.redhat.com/errata/RHSA-2010-0095.htmlThird Party Advisory
FAQ
What is CVE-2010-0298?
CVE-2010-0298 is a vulnerability with a CVSS score of 6.5 (MEDIUM). The x86 emulator in KVM 83 does not use the Current Privilege Level (CPL) and I/O Privilege Level (IOPL) in determining the memory access available to CPL3 code, which allows guest OS users to cause a...
How severe is CVE-2010-0298?
CVE-2010-0298 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2010-0298?
Check the references section above for vendor advisories and patch information. Affected products include: Linux Linux Kernel, Debian Debian Linux.