CVE-2015-3214: QEMU-KVM PIT Out-of-Bounds Memory Access Leading to RCE

Key Information Vulnerability ID: - Red Hat Bugzilla: Bug 1229640 - CVE ID: CVE-2015-3214 Vulnerability Description: - - Reading from the PIO mode/command registers may result in out-of-bounds memory access to PIT channels due to invalid indexing, potentially causing memory corruption and information leakage. - A privileged guest with QEMU PIT emulation enabled in a virtual machine may (with difficulty) exploit this vulnerability to execute arbitrary code on the host with the privileges of the QEMU process. - A privileged guest user in a virtual machine may (with difficulty) exploit this vulnerability to execute arbitrary code on the host (KVM portion of the vulnerability). Affected Products and Versions: - Red Hat Enterprise Linux 7 library - Red Hat Enterprise Linux 7 library - Red Hat Enterprise Virtualization 3 library - Red Hat Enterprise Linux 5 library Fix Status: - Upstream fix patch provided - This vulnerability has been addressed in RHSA-2015:1507, RHSA-2015:1508, and RHSA-2015:1512 - Fix packages provided for Red Hat Enterprise Linux, RHEV-H, Agents for RHEL, OpenStack, and Fedora - Specific fix progress for affected versions mentioned Priority and Severity: - Priority: medium - Severity: medium Reporting and Closure Times: - Reported: 2015-06-09 10:23 UTC - Closed: 2015-07-28 22:51:28 UTC Attachments: - Upstream Submissions: - KVM portion: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ee73f656a604d5aa9df86a97102e4e462dd79924 - QEMU portion: http://git.qemu.org/?p=qemu.git;a=commit;h=d4862a87e31a51de9eb260f25c9e99a75efe3235 Additional Information: - Reported by Matt Tait of Google’s Project Zero security team - Fedora version fix status mentioned

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2015-3214: QEMU-KVM PIT Out-of-Bounds Memory Access Leading to RCE