Mandriva Linux Security Advisory 2013-121 - A flaw was found in how qemu, in snapshot mode (-snapshot command line argument), handled the creation and opening of the temporary file used to store the difference of the virtualized guest's read-only image and the current state. In snapshot mode, bdrv_open() creates an empty temporary file without checking for any mkstemp() or close() failures; it also ignores the possibility of a buffer overrun given an exceptionally long /tmp. Because qemu re-opens that file after creation, it is possible to race qemu and insert a symbolic link with the same expected name as the temporary file, pointing to an attacker-chosen file. This can be used to either overwrite the destination file with the privileges of the user running qemu , or to point to an attacker-readable file that could expose data from the guest to the attacker. A flaw was found in the way QEMU handled VT100 terminal escape sequences when emulating certain character devices. A guest user with privileges to write to a character device that is emulated on the host using a virtual console back-end could use this flaw to crash the qemu-kvm process on the host or, possibly, escalate their privileges on the host. It was discovered that the e1000 emulation code in QEMU does not enforce frame size limits in the same way as the real hardware does. This could trigger buffer overflows in the guest operating system driver for that network card, assuming that the host system does not discard such frames.
0f5d0689948e74e63089abe6af1a0447a0fe343b5e6c2298fef30b4a9d5cf5b8Gentoo Linux Security Advisory 201210-4 - Multiple vulnerabilities were found in qemu-kvm, allowing attackers to execute arbitrary code. Versions less than 1.1.1-r1 are affected.
06a3dcc607829516f85c54a5f5e6c417bc1c799c5779cfc55ea88d07821757e1Debian Linux Security Advisory 2545-1 - Multiple vulnerabilities have been discovered in qemu, a fast processor emulator.
8e5c7692bbe174766d9b636a0cc8c8fe9870a09a5a9c7ad9cfbcae5653433f52Debian Linux Security Advisory 2542-1 - Multiple vulnerabilities have been discovered in qemu-kvm, a full virtualization solution on x86 hardware.
00685f3c7620cdca669660f768658bfc96ecb973fbc7077496fc77baee3a9f0fUbuntu Security Notice 1522-1 - It was discovered that QEMU incorrectly handled temporary files when creating a snapshot. A local attacker could use this flaw to possibly overwrite files with root privilege, or obtain sensitive information from the guest.
9a96046f611179598508962e3bccfce9d4f8cb6f6fd7793db2d72a52a89eb5d1
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed