Description
The main function in tools/hv/hv_kvp_daemon.c in hypervkvpd, as distributed in the Linux kernel before 3.8-rc1, allows local users to cause a denial of service (daemon exit) via a crafted application that sends a Netlink message. NOTE: this vulnerability exists because of an incorrect fix for CVE-2012-2669.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | hypervkvpd | 0-0.7.el5_9.3 | RHSA-2013:0807 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Virtualization 5 | hypervkvpd | 0-0.7.el5_9.3 | RHSA-2013:0807 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | hyper-v | 6-17.5 | openSUSE-SU-2024:10513-1 |
Advisories 2
- RHSA-2013:0807 Red Hat Security Advisory: hypervkvpd security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- openSUSE-SU-2024:10513-1 hyper-v-6-17.5 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- http://www.kernel.org/pub/linux/kernel/v3.x/testing/patch-3.8-rc1.bz2
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=95a69adab9acfc3981c504737a2b6578e4d846ef
- MDVSA-2013:176 vendor-advisory
- https://bugzilla.novell.com/show_bug.cgi?id=761200
- [oss-security] 20121127 Re: CVE-2012-5532 hypervkvpd DoS mailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=877572
- http://www.kernel.org/pub/linux/kernel/v3.x/testing/
- https://github.com/torvalds/linux/commit/95a69adab9acfc3981c504737a2b6578e4d846ef
- RHSA-2013:0807 vendor-advisory
- kernel-hypervkvpd-dos(80337) vdb-entry
- 56710 vdb-entry