CVE-2015-3214 The pit_ioport_read in i8254.c in the Linux kernel before 2.6.33 and QEMU before 2.3.1 does not distinguish between read lengths and write lengths, which might allow guest OS users to execute arbitrar...
MediumCVSS 6.9
EPSS 1.6%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
The pit_ioport_read in i8254.c in the Linux kernel before 2.6.33 and QEMU before 2.3.1 does not distinguish between read lengths and write lengths, which might allow guest OS users to execute arbitrary code on the host OS by triggering use of an invalid index.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/qemu(Debian:12) | < 1:2.4+dfsg-1a | 1:2.4+dfsg-1a |
| debian/qemu(Debian:13) | < 1:2.4+dfsg-1a | 1:2.4+dfsg-1a |
| debian/qemu(Debian:14) | < 1:2.4+dfsg-1a | 1:2.4+dfsg-1a |
| debian/xen(Debian:12) | < 4.4.0-1 | 4.4.0-1 |
| debian/xen(Debian:13) | < 4.4.0-1 | 4.4.0-1 |
| debian/xen(Debian:14) | < 4.4.0-1 | 4.4.0-1 |
| qemu | <= 2.3.0 | No fix listed |
| Linux kernel | <= 2.6.32 | No fix listed |
| arista eos | = 4.12 | No fix listed |
| arista eos | = 4.13 | No fix listed |
| arista eos | = 4.14 | No fix listed |
| arista eos | = 4.15 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| Lenovo emc px12-400r ivx | < 1.0.10.33264 | 1.0.10.33264 |
| Lenovo emc px12-450r ivx | < 1.0.10.33264 | 1.0.10.33264 |
| redhat openstack | = 5.0 | No fix listed |
| redhat openstack | = 6.0 | No fix listed |
| redhat virtualization | = 3.0 | No fix listed |
| redhat enterprise linux compute node eus | = 7.1 | No fix listed |
| redhat enterprise linux compute node eus | = 7.2 | No fix listed |
| redhat enterprise linux compute node eus | = 7.3 | No fix listed |
| redhat enterprise linux compute node eus | = 7.4 | No fix listed |
| redhat enterprise linux compute node eus | = 7.5 | No fix listed |
| redhat enterprise linux compute node eus | = 7.6 | No fix listed |
Show 32 more
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat enterprise linux compute node eus | = 7.7 | No fix listed |
| redhat enterprise linux for power big endian | = 7.0 | No fix listed |
| redhat enterprise linux for power big endian eus | = 7.1_ppc64 | No fix listed |
| redhat enterprise linux for power big endian eus | = 7.2_ppc64 | No fix listed |
| redhat enterprise linux for power big endian eus | = 7.3_ppc64 | No fix listed |
| redhat enterprise linux for power big endian eus | = 7.4_ppc64 | No fix listed |
| redhat enterprise linux for power big endian eus | = 7.5_ppc64 | No fix listed |
| redhat enterprise linux for power big endian eus | = 7.6_ppc64 | No fix listed |
| redhat enterprise linux for power big endian eus | = 7.7_ppc64 | No fix listed |
| redhat enterprise linux for scientific computing | = 7.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server aus | = 7.3 | No fix listed |
| redhat enterprise linux server aus | = 7.4 | No fix listed |
| redhat enterprise linux server aus | = 7.6 | No fix listed |
| redhat enterprise linux server aus | = 7.7 | No fix listed |
| redhat enterprise linux server eus | = 7.1 | No fix listed |
| redhat enterprise linux server eus | = 7.2 | No fix listed |
| redhat enterprise linux server eus | = 7.3 | No fix listed |
| redhat enterprise linux server eus | = 7.4 | No fix listed |
| redhat enterprise linux server eus | = 7.5 | No fix listed |
| redhat enterprise linux server eus | = 7.6 | No fix listed |
| redhat enterprise linux server eus | = 7.7 | No fix listed |
| redhat enterprise linux server from rhui | = 7.0 | No fix listed |
| redhat enterprise linux server tus | = 7.3 | No fix listed |
| redhat enterprise linux server tus | = 7.6 | No fix listed |
| redhat enterprise linux server tus | = 7.7 | No fix listed |
| redhat enterprise linux server update services for sap solutions | = 7.2 | No fix listed |
| redhat enterprise linux server update services for sap solutions | = 7.3 | No fix listed |
| redhat enterprise linux server update services for sap solutions | = 7.4 | No fix listed |
| redhat enterprise linux server update services for sap solutions | = 7.6 | No fix listed |
| redhat enterprise linux server update services for sap solutions | = 7.7 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
References
- Debian Security Tracker CVE-2015-3214 vendor-advisory
- bugs.debian.org issue-tracking
- git.kernel.org patch vendor-advisory
- mirror.linux.org.au broken-link vendor-advisory
- RHSA-2015:1507 issue-tracking third-party-advisory vendor-advisory
- RHSA-2015:1508 issue-tracking third-party-advisory vendor-advisory
- RHSA-2015:1512 third-party-advisory vendor-advisory
- DSA-3348 issue-tracking third-party-advisory vendor-advisory
- [oss-security] 20150625 Re: CVE request -- Linux kernel - kvm: x86: out-of-bounds memory access in pit_ioport_read function mailing-list
- 75273 third-party-advisory vdb-entry
- 1032598 third-party-advisory vdb-entry
- bugzilla.redhat.com issue-tracking
- github.com patch third-party-advisory
- GLSA-201510-02 issue-tracking third-party-advisory vendor-advisory
- support.lenovo.com third-party-advisory
- support.lenovo.com third-party-advisory
- www.arista.com third-party-advisory
- 37990 exploit third-party-advisory vdb-entry
- [qemu-devel] 20150617 Re: [PATCH] i8254: fix out-of-bounds memory access in pit_ioport_read() mailing-list