Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.9

Linux KVM may crash or run code from local users

CVE-2012-2137 · published 13 years ago
Summary

The built‑in virtual machine manager in Linux kernels older than version 3.2.24 has a programming error that lets someone with a normal account cause the system to stop working or possibly run their own programs. This risk is limited to users who can log onto the machine, but it can disrupt services or lead to a breach. Upgrade the Linux kernel to version 3.2.24 or later, or apply the supplied security patch, and restrict local user privileges where possible.

What to do
  • Update debian linux to version 3.2.20-1.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian linux < 3.2.20-1
Fix: upgrade to 3.2.20-1
Debian:13 debian linux < 3.2.20-1
Fix: upgrade to 3.2.20-1
Debian:14 debian linux < 3.2.20-1
Fix: upgrade to 3.2.20-1
– linux linux_kernel >= 2.6.33, < 3.0.72
>= 3.1, < 3.2.24
>= 3.3, < 3.4.81
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
– canonical ubuntu_linux 10.04
11.10
12.04
cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*
Original advisory text
Buffer overflow in virt/kvm/irq_comm.c in the KVM subsystem in the Linux kernel before 3.2.24 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via vectors...
Buffer overflow in virt/kvm/irq_comm.c in the KVM subsystem in the Linux kernel before 3.2.24 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to Message Signaled Interrupts (MSI), irq routing entries, and an incorrect check by the setup_routing_entry function before invoking the kvm_set_irq function.
References
Severity
6.9 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-119Buffer Overflow
Timeline
Published22 Jan 2013
Updated4 Nov 2026
First seen5 Sep 2026
Sources
DEBIAN-CVE-2012-2137 · OSV
CVE-2012-2137 · NVD
Track software like this
Free during beta