K62700573 : Linux kernel vulnerabilities CVE-2010-5313 and CVE-2014-7842

Security Advisory Description

• CVE-2010-5313

Race condition in arch/x86/kvm/x86.c in the Linux kernel before 2.6.38 allows L2 guest OS users to cause a denial of service (L1 guest OS crash) via a crafted instruction that triggers an L2 emulation failure report, a similar issue to CVE-2014-7842.

• CVE-2014-7842

Race condition in arch/x86/kvm/x86.c in the Linux kernel before 3.17.4 allows guest OS users to cause a denial of service (guest OS crash) via a crafted application that performs an MMIO transaction or a PIO transaction to trigger a guest userspace emulation error report, a similar issue to CVE-2010-5313.
Impact
A local user with advanced shell(bash) access on a Virtual Clustered Multiprocessing (vCMP) guest may be able to use this flaw to cause a complete impact of availability for the guest only. This vulnerability is rated as a medium risk for vCMP guests and does not impact the host hypervisor. This issue does not affect non-vCMP deployments.