Vigil@nce - Linux kernel: privilege escalation via KVM SYSENTER
February 2015 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
A local attacker can use the SYSENTER instruction on KVM of the
Linux kernel, in order to escalate his privileges.
Impacted products: Fedora, Linux
Severity: 2/4
Creation date: 27/01/2015
DESCRIPTION OF THE VULNERABILITY
The SYSENTER assembler instruction is used to manage the
initiation of a system call.
It is emulated by the KVM module of the Linux kernel. However in
16 bit mode, if the guest system does not initialize the MSR
(Model Specific Register), an exception is not handled, and the
CPL (Code Privilege Level) is reset (which means privileged).
A local attacker can therefore use the SYSENTER instruction on KVM
of the Linux kernel, in order to escalate his privileges.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
http://vigilance.fr/vulnerability/Linux-kernel-privilege-escalation-via-KVM-SYSENTER-16062