Secure testing team - Dec 2009 - Bug#562076: CVE-2009-3638: Integer overflow in the kvm_dev_ioctl_get_supported_cpuid function

Package: kvm
Severity: grave
Tags: security

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


Hi,
the following CVE (Common Vulnerabilities & Exposures) id was
published for kvm.

CVE-2009-3638[0]:
| Integer overflow in the kvm_dev_ioctl_get_supported_cpuid function in
| arch/x86/kvm/x86.c in the KVM subsystem in the Linux kernel before
| 2.6.31.4 allows local users to have an unspecified impact via a
| KVM_GET_SUPPORTED_CPUID request to the kvm_arch_dev_ioctl function.

If you fix the vulnerability please also make sure to include the
CVE id in your changelog entry.

For further information see:

[0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3638
    http://security-tracker.debian.org/tracker/CVE-2009-3638


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.10 (GNU/Linux)

iEYEARECAAYFAkswyCcACgkQNxpp46476aodswCbBhUlXpMcGEOyZyftiw6qE+t6
GP0An389JcLUJRqd0J0pmVt/sSI7OOlf
=BE85
-----END PGP SIGNATURE-----