Vulnerability Name:

CVE-2010-2938 (CCN-62180)

Assigned:2010-09-29
Published:2010-09-29
Updated:2018-10-10
Summary:arch/x86/hvm/vmx/vmcs.c in the virtual-machine control structure (VMCS) implementation in the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5, when an Intel platform without Extended Page Tables (EPT) functionality is used, accesses VMCS fields without verifying hardware support for these fields, which allows local users to cause a denial of service (host OS crash) by requesting a VMCS dump for a fully virtualized Xen guest.
CVSS v3 Severity:4.0 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Low
CVSS v2 Severity:4.9 Medium (CVSS v2 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:C)
3.7 Low (Temporal CVSS v2 Vector: AV:L/AC:L/Au:N/C:N/I:N/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Complete
1.9 Low (CCN CVSS v2 Vector: AV:L/AC:M/Au:N/C:N/I:N/A:P)
1.4 Low (CCN Temporal CVSS v2 Vector: AV:L/AC:M/Au:N/C:N/I:N/A:P/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
5.5 Medium (REDHAT CVSS v2 Vector: AV:A/AC:L/Au:S/C:N/I:N/A:C)
4.1 Medium (REDHAT Temporal CVSS v2 Vector: AV:A/AC:L/Au:S/C:N/I:N/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Adjacent_Network
Access Complexity (AC): Low
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Complete
Vulnerability Type:CWE-399
Vulnerability Consequences:Denial of Service
References:Source: MITRE
Type: CNA
CVE-2010-2938

Source: CCN
Type: RHSA-2010-0723
Important: kernel security and bug fix update

Source: CCN
Type: SA46397
VMware ESX / ESXi Server Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
46397

Source: CONFIRM
Type: UNKNOWN
http://support.avaya.com/css/P8/documents/100113326

Source: CCN
Type: The Linux Kernel Archives Web site
The Linux Kernel Archives

Source: CCN
Type: OSVDB ID: 68631
Linux Kernel on RHEL VMCS arch/x86/hvm/vmx/vmcs.c Hardware Support Verification Weakness Host OS Local DoS

Source: REDHAT
Type: UNKNOWN
RHSA-2010:0723

Source: BUGTRAQ
Type: UNKNOWN
20111013 VMSA-2011-0012 VMware ESXi and ESX updates to third party libraries and ESX Service Console

Source: BID
Type: UNKNOWN
43578

Source: CCN
Type: BID-43578
Linux Kernel Xen Hypervisor Implementation Denial of Service Vulnerability

Source: CONFIRM
Type: UNKNOWN
http://www.vmware.com/security/advisories/VMSA-2011-0012.html

Source: CONFIRM
Type: UNKNOWN
http://xenbits.xensource.com/xen-unstable.hg?rev/15911

Source: CCN
Type: Red Hat Bugzilla Bug 620490
CVE-2010-2938 kernel: guest crashes on non-EPT machines may crash the host as well

Source: CONFIRM
Type: UNKNOWN
https://bugzilla.redhat.com/show_bug.cgi?id=620490

Source: XF
Type: UNKNOWN
kernel-xen-dos(62180)

Vulnerable Configuration:Configuration 1:
  • cpe:/o:linux:linux_kernel:2.6.18:-:*:*:*:*:*:*
  • AND
  • cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/o:redhat:enterprise_linux:5::client:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:5::server:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:23145
    P
    		ELSA-2010:0723: kernel security and bug fix update (Important)
    2014-05-26
    oval:org.mitre.oval:def:22277
    P
    		RHSA-2010:0723: kernel security and bug fix update (Important)
    2014-02-24
    oval:org.mitre.oval:def:20124
    V
    		VMware ESX third party updates for Service Console packages glibc and dhcp
    2014-01-20
    oval:com.redhat.rhsa:def:20100723
    P
    		RHSA-2010:0723: kernel security and bug fix update (Important)
    2010-09-29
    BACK
    linux linux kernel 2.6.18
    redhat enterprise linux 5