CVE-2014-0077

drivers/vhost/net.c en el kernel de Linux anterior a 3.13.10, cuando buffers combinables están deshabilitados, no valida debidamente los longitudes de paquetes, lo que permite a usuarios invitados del sistema operativo causar una denegación de servicio (corrupción de memoria y caída del sistema operativo anfitrión) o posiblemente ganar privilegios en el sistema operativo anfitrión a través de paquetes manipulados, relacionado con las funciones handle_rx y get_rx_bufs.

The kernel packages contain the Linux kernel, the core of any Linux operating system. A flaw was found in the way the Linux kernel's netfilter connection tracking implementation for Datagram Congestion Control Protocol packets used the skb_header_pointer() function. A remote attacker could use this flaw to send a specially crafted DCCP packet to crash the system or, potentially, escalate their privileges on the system. A flaw was found in the way the handle_rx() function handled large network packets when mergeable buffers were disabled. A privileged guest user could use this flaw to crash the host or corrupt QEMU process memory on the host, which could potentially result in arbitrary code execution on the host with the privileges of the QEMU process.