Description
The translate_desc function in drivers/vhost/vhost.c in the Linux kernel before 3.7 does not properly handle cross-region descriptors, which allows guest OS users to obtain host OS privileges by leveraging KVM guest OS privileges.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 3.2.41-1 | — |
| Debian 13 | linux | 3.2.41-1 | — |
| Debian 12 | linux | 3.2.41-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | perf +15 | 2.6.32-358.el6 | RHSA-2013:0496 |
| RHEL 6 | rhev-hypervisor6 | 6.4-20130221.0.el6 | RHSA-2013:0579 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6.3 EUS | perf +15 | 2.6.32-279.31.1.el6 | RHSA-2013:0928 |
| RHEL 6.2 EUS | perf +15 | 2.6.32-220.38.1.el6 | RHSA-2013:0882 |
Advisories 4
- RHSA-2013:0928 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2013:0882 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2013:0579 Red Hat Security Advisory: rhev-hypervisor6 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2013:0496 Red Hat Security Advisory: Red Hat Enterprise Linux 6 kernel update Red Hat Security Advisories (RHSA) · Jun 28, 2026
References
- RHSA-2013:0496 vendor-advisory
- openSUSE-SU-2013:1187 vendor-advisory
- https://github.com/torvalds/linux/commit/bd97120fc3d1a11f3124c7c9ba1d91f51829eb85
- RHSA-2013:0882 vendor-advisory
- MDVSA-2013:176 vendor-advisory
- RHSA-2013:0928 vendor-advisory
- [oss-security] 20130219 Re: CVE request -- Linux kernel: vhost: fix length for cross region descriptor mailing-list
- RHSA-2013:0579 vendor-advisory
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=bd97120fc3d1a11f3124c7c9ba1d91f51829eb85
- https://bugzilla.redhat.com/show_bug.cgi?id=912905
- http://www.kernel.org/pub/linux/kernel/v3.x/patch-3.7.bz2