CVE-2019-14835

What it actually does

Buffer overflow in vhost code that translates virtqueue buffers to IOVs and logs descriptors during migration, allowing a privileged guest to corrupt host memory and escalate privileges.

Why it matters to the business

Attackers with guest access could fully compromise the virtualization host, leading to loss of isolation, data exposure, and control over all VMs on the system; the issue has been public for years with exploits available though current exploitation probability remains low.

How an attack unfolds

A privileged guest user supplies virtqueue buffer descriptors with invalid lengths while live migration is active; the host vhost logging path fails to validate lengths, triggering an overflow that the attacker leverages to execute code with host privileges.

How to fix it

Upgrade affected systems to a kernel version beyond 5.2.x that contains the fix; for php/php-src (GIT) apply commit 8722983775497294485ecb48bec607a22b9acdb4.

How to confirm the fix worked

Verify kernel version is newer than 5.2.x or the listed php commit is present; test migration with previously malicious descriptor lengths to confirm no crash or privilege gain occurs.

Typical attack path

1. Confirm target runs vulnerable kernel (2.6.34-5.2.x) with vhost enabled
2. Initiate or trigger a live migration of the guest
3. Pass crafted descriptors containing excessive lengths from guest userspace
4. Trigger the logging code path on the host to overflow the buffer
5. Use resulting memory corruption to escalate to host root privileges

How to detect it

Review host kernel logs and migration audit trails for vhost buffer descriptor logging anomalies or unexpected privilege changes during live migration events; correlate with guest activity around migration start times.

What your security team should do

• Prioritize patching hosts running vhost-enabled kernels in the affected range
• Restrict live migration to trusted networks and limit guest privileges where possible
• Monitor EPSS trend and exploit availability for any change in urgency