Vulnerability Name:

CVE-2010-2784 (CCN-61267)

Assigned:2010-07-28
Published:2010-07-28
Updated:2010-08-25
Summary:The subpage MMIO initialization functionality in the subpage_register function in exec.c in QEMU-KVM, as used in the Hypervisor (aka rhev-hypervisor) in Red Hat Enterprise Virtualization (RHEV) 2.2 and KVM 83, does not properly select the index for access to the callback array, which allows guest OS users to cause a denial of service (guest OS crash) or possibly gain privileges via unspecified vectors.
CVSS v3 Severity:7.5 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): High
Privileges Required (PR): Low
User Interaction (UI): Required
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:6.6 Medium (CVSS v2 Vector: AV:L/AC:M/Au:S/C:C/I:C/A:C)
4.9 Medium (Temporal CVSS v2 Vector: AV:L/AC:M/Au:S/C:C/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Medium
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
6.6 Medium (CCN CVSS v2 Vector: AV:L/AC:M/Au:S/C:C/I:C/A:C)
4.9 Medium (CCN Temporal CVSS v2 Vector: AV:L/AC:M/Au:S/C:C/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Medium
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
6.6 Medium (REDHAT CVSS v2 Vector: AV:L/AC:M/Au:S/C:C/I:C/A:C)
4.9 Medium (REDHAT Temporal CVSS v2 Vector: AV:L/AC:M/Au:S/C:C/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Medium
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-264
Vulnerability Consequences:Gain Privileges
References:Source: CCN
Type: QEMU Web page
QEMU

Source: MITRE
Type: CNA
CVE-2010-2784

Source: CCN
Type: RHSA-2010-0622
Important: rhev-hypervisor security and bug fix update

Source: CCN
Type: RHSA-2010-0627
Important: kvm security and bug fix update

Source: CCN
Type: OSVDB ID: 67473
QEMU-KVM exec.c subpage_register Function MMIO Initialization Callback Array Access Guest OS DoS

Source: CCN
Type: BID-42579
QEMU KVM 'exec.c:subpage_register()' Memory Corruption Vulnerability

Source: MLIST
Type: UNKNOWN
[kvm] 20100728 [PATCH 1/2] Fix segfault in mmio subpage handling code

Source: CCN
Type: Red Hat Bugzilla Bug 619411
CVE-2010-2784 qemu: insufficient constraints checking in exec.c:subpage_register()

Source: CONFIRM
Type: UNKNOWN
https://bugzilla.redhat.com/show_bug.cgi?id=619411

Source: XF
Type: UNKNOWN
qemu-execcsubpageregister-priv-escalation(61267)

Source: REDHAT
Type: Patch, Vendor Advisory
RHSA-2010:0622

Source: REDHAT
Type: Patch, Vendor Advisory
RHSA-2010:0627

Vulnerable Configuration:Configuration 1:
  • cpe:/a:redhat:enterprise_virtualization:2.2:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:kvm:83:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/a:redhat:rhel_virtualization:5:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/a:redhat:rhel_virtualization:5::client:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/a:redhat:rhel_virtualization:5::server:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:fabrice_bellard:qemu:0.8.2:*:*:*:*:*:*:*
  • AND
  • cpe:/a:redhat:rhel_virtualization:5:*:server:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:5:*:client:*:*:*:*:*
  • OR cpe:/a:redhat:enterprise_virtualization:2.2:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:23083
    P
    		ELSA-2010:0627: kvm security and bug fix update (Important)
    2014-05-26
    oval:org.mitre.oval:def:21834
    P
    		RHSA-2010:0627: kvm security and bug fix update (Important)
    2014-02-24
    oval:com.redhat.rhsa:def:20100627
    P
    		RHSA-2010:0627: kvm security and bug fix update (Important)
    2010-08-19
    BACK
    redhat enterprise virtualization 2.2
    redhat kvm 83
    fabrice_bellard qemu 0.8.2
    redhat rhel virtualization 5
    redhat enterprise linux 5
    redhat enterprise virtualization 2.2