Description
The KVM implementation in the Linux kernel before 3.3.4 does not properly manage the relationships between memory slots and the iommu, which allows guest OS users to cause a denial of service (memory leak and host OS crash) by leveraging administrative access to the guest OS to conduct hotunplug and hotplug operations on devices.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | linux-2.6 | 2.6.32-48squeeze3 | DSA-2668-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | perf +15 | 2.6.32-220.23.1.el6 | RHSA-2012:0743 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Virtualization 5 | kvm +4 | 83-249.el5_8.4 | RHSA-2012:0676 |
Advisories 3
- RHSA-2012:0743 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2012:0676 Red Hat Security Advisory: kvm security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- DSA-2668-1 linux-2.6 - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- 50732 third-party-advisory
- RHSA-2012:0743 vendor-advisory
- 1027083 vdb-entry
- [oss-security] 20120419 Re: CVE request -- kernel: kvm: device assignment page leak mailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=814149
- https://github.com/torvalds/linux/commit/09ca8e1173bcb12e2a449698c9ae3b86a8a10195
- USN-1577-1 vendor-advisory
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.3.4
- USN-2036-1 vendor-advisory
- USN-2037-1 vendor-advisory
- RHSA-2012:0676 vendor-advisory