CVE-2019-7221 - log back

CVE-2019-7221 created at 25 Sep 2019 19:31:40
Severity
+ Critical
Remote
+ Local
Type
+ Privilege escalation
Description
+ A use-after-free vulnerability was found in the way the Linux kernel's KVM hypervisor emulates a preemption timer for L2 guests when nested (=1) virtualization is enabled. This high resolution timer(hrtimer) runs when a L2 guest is active. After VM exit, the sync_vmcs12() timer object is stopped. The use-after-free occurs if the timer object is freed before calling sync_vmcs12() routine. A guest user/process could use this flaw to crash the host kernel resulting in a denial of service or, potentially, gain privileged access to a system.
References
+ https://bugs.chromium.org/p/project-zero/issues/detail?id=1759&desc=2
+ https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=353c0956a618a07ba4bbe7ad00ff29fe70e8412a
Notes