CVE-2009-4004

Vulnerability

A buffer overflow exists in the kvm_vcpu_ioctl_x86_setup_mce function in arch/x86/kvm/x86.c in the Linux kernel's KVM subsystem before version 2.6.32-rc7. The vulnerability occurs when a local user sends a KVM_X86_SETUP_MCE IOCTL request specifying a large number of Machine Check Exception (MCE) banks, which overflows a fixed-size buffer. This code path is reachable via direct IOCTL calls to KVM devices. [1]

Exploitation

An attacker needs local access to the system and the ability to open an KVM device file (e.g., /dev/kvm). The exploit involves crafting a KVM_X86_SETUP_MCE IOCTL with a large value in the bank count field, triggering the buffer overflow during memory copy operations. No special privileges beyond local user access are required. [1]

Impact

Successful exploitation can cause memory corruption leading to a denial of service (system crash) or potentially allow an attacker to gain elevated privileges (root). The overflow targets kernel memory, giving the attacker control over execution flow. [1]

Mitigation

The fix was included in Linux kernel version 2.6.32-rc7, released November 2009. Users should upgrade to a kernel version 2.6.32-rc7 or later. No workaround is available; the affected code is removed in the fixed version. [1]