CVE-2019-14835

Name of the Vulnerable Software and Affected Versions Linux kernel versions 2.6.34 through 5.2.x

Description A buffer overflow flaw was found in the Linux kernel's vhost functionality, which translates virtqueue buffers to IOVs and logs buffer descriptors during migration. This flaw can be exploited by a privileged guest user who can pass descriptors with invalid length to the host during migration, potentially increasing their privileges on the host. The issue is related to the vhost-net module, which is a network backend for virtio, and can be used to bypass isolation in systems based on QEMU-KVM.

Recommendations For Linux kernel versions 2.6.34 through 5.2.x, consider disabling the vhost functionality or restricting access to it until a patch is available. As a temporary workaround, avoid using the vhost-net module during virtual machine migration. There is no information about a newer version that contains a fix for this vulnerability.