CVE-2023-5090
Assigner: redhat
Published: 2023-11-06T10:56:57.062Z
State: PUBLISHED
title: Kernel: kvm: svm: improper check in svm_set_x2apic_msr_interception allows direct access to host x2apic msrs
metrics: other: content: value: Moderate
namespace: https://access.redhat.com/security/updates/classification/
type: Red Hat severity rating
cvssV3_1: attackComplexity: LOW
attackVector: LOCAL
availabilityImpact: HIGH
baseScore: 6
baseSeverity: MEDIUM
confidentialityImpact: NONE
integrityImpact: NONE
privilegesRequired: HIGH
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
version: 3.1
format: CVSS
descriptions: value: A flaw was found in KVM. An improper check in svm_set_x2apic_msr_interception() may allow direct access to host x2apic msrs when the guest resets its apic, potentially leading to a denial of service condition.
affected: vendor: Red Hat
product: Red Hat Enterprise Linux 6
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: kernel
defaultStatus: unaffected
cpes: cpe:/o:redhat:enterprise_linux:6
vendor: Red Hat
product: Red Hat Enterprise Linux 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: kernel
defaultStatus: unaffected
cpes: cpe:/o:redhat:enterprise_linux:7
vendor: Red Hat
product: Red Hat Enterprise Linux 7
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: kernel-rt
defaultStatus: unaffected
cpes: cpe:/o:redhat:enterprise_linux:7
vendor: Red Hat
product: Red Hat Enterprise Linux 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: kernel
defaultStatus: affected
cpes: cpe:/o:redhat:enterprise_linux:8
vendor: Red Hat
product: Red Hat Enterprise Linux 8
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: kernel-rt
defaultStatus: affected
cpes: cpe:/o:redhat:enterprise_linux:8
vendor: Red Hat
product: Red Hat Enterprise Linux 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: kernel
defaultStatus: affected
cpes: cpe:/o:redhat:enterprise_linux:9
vendor: Red Hat
product: Red Hat Enterprise Linux 9
collectionURL: https://access.redhat.com/downloads/content/package-browser/
packageName: kernel-rt
defaultStatus: affected
cpes: cpe:/o:redhat:enterprise_linux:9
datePublic: 2023-09-28T00:00:00+00:00
problemTypes: descriptions: cweId: CWE-755
description: Improper Handling of Exceptional Conditions
type: CWE
x_redhatCweChain: CWE-755: Improper Handling of Exceptional Conditions
workarounds: value: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
timeline: time: 2023-09-20T00:00:00+00:00
value: Reported to Red Hat.
time: 2023-09-28T00:00:00+00:00
value: Made public.
credits: value: This issue was discovered by Maxim Levitsky (Red Hat).