CVE-2015-4692

What it actually does

The kvm_apic_has_events function in arch/x86/kvm/lapic.h performs insufficient validation of APIC state before dereferencing a pointer, allowing a NULL pointer dereference when invoked via an ioctl on /dev/kvm.

Why it matters to the business

Local users with KVM access can crash affected Linux systems, causing unplanned downtime and potential loss of virtualized workloads on hosts running unpatched kernels.

How an attack unfolds

An attacker with local access and permission to open /dev/kvm crafts a specific ioctl call that reaches kvm_apic_has_events with an uninitialized or NULL APIC structure, triggering the dereference and kernel panic.

How to fix it

Upgrade the Linux kernel to a version containing the fix for the NULL pointer handling in kvm_apic_has_events; apply the latest stable kernel package from the distribution vendor and reboot affected hosts.

How to confirm the fix worked

Confirm the running kernel version is newer than 4.1.3 and contains the upstream commit that initializes or validates the APIC pointer before the dereference; re-test ioctl paths in a lab environment if possible.

Typical attack path

1. Obtain a local shell on a Linux system exposing /dev/kvm
2. Ensure membership in the kvm group or equivalent privileges to open the device
3. Invoke an ioctl that exercises the kvm_apic_has_events code path with attacker-controlled APIC state
4. Trigger NULL dereference resulting in immediate system crash

How to detect it

Review kernel panic logs and dmesg output for KVM APIC or lapic NULL pointer dereference messages; correlate with audit logs showing unexpected ioctl activity on /dev/kvm from non-standard processes.

What your security team should do

• Prioritize kernel updates on all systems exposing /dev/kvm to untrusted local users
• Restrict /dev/kvm access via group membership and device ACLs to the minimum required users
• Monitor kernel crash logs for KVM-related NULL pointer faults until patches are deployed