Executive Summary
| Summary | |
|---|---|
| Title | QEMU vulnerabilities |
| Informations | |||
|---|---|---|---|
| Name | USN-1145-1 | First vendor Publication | 2011-06-09 |
| Vendor | Ubuntu | Last vendor Modification | 2011-06-09 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:A/AC:M/Au:S/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 7.4 | Attack Range | Adjacent network |
| Cvss Impact Score | 10 | Attack Complexity | Medium |
| Cvss Expoit Score | 4.4 | Authentication | Requires single instance |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 11.04 - Ubuntu 10.10 - Ubuntu 10.04 LTS Summary: A privileged attacker within a QEMU guest could cause QEMU to crash. Software Description: - qemu-kvm: Machine emulator and virtualizer Details: It was discovered that QEMU did not properly perform validation of I/O operations from the guest which could lead to heap corruption. An attacker could exploit this to cause a denial of service of the guest or possibly execute code with the privileges of the user invoking the program. (CVE-2011-1750) Nelson Elhage discoverd that QEMU did not properly handle memory when removing ISA devices. An attacker could exploit this to cause a denial of service of the guest or possibly execute code with the privileges of the user invoking the program. (CVE-2011-1751) When using QEMU with libvirt or virtualization management software based on libvirt such as Eucalyptus and OpenStack, QEMU guests are individually isolated by an AppArmor profile by default in Ubuntu. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 11.04: Ubuntu 10.10: Ubuntu 10.04 LTS: After a standard system update you need to restart running virtual machines to make all the necessary changes. References: Package Information: |
Original Source
| Url : http://www.ubuntu.com/usn/USN-1145-1 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 50 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
| 50 % | CWE-20 | Improper Input Validation |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:12667 | |||
| Oval ID: | oval:org.mitre.oval:def:12667 | ||
| Title: | DSA-2241-1 qemu-kvm -- implementation error | ||
| Description: | Nelson Elhage discovered that incorrect memory handling during the removal of ISA devices in KVM, a solution for full virtualization on x86 hardware, could lead to denial of service of the execution of arbitrary code. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2241-1 CVE-2011-1751 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 6.0 Debian GNU/kFreeBSD 6.0 | Product(s): | qemu-kvm |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:12987 | |||
| Oval ID: | oval:org.mitre.oval:def:12987 | ||
| Title: | DSA-2230-1 qemu-kvm -- several | ||
| Description: | Two vulnerabilities have been discovered in KVM, a solution for full virtualization on x86 hardware: CVE-2011-0011 Setting the VNC password to an empty string silently disabled all authentication. CVE-2011-1750 The virtio-blk driver performed insufficient validation of read/write I/O from the guest instance, which could lead to denial of service or privilege escalation. The oldstable distribution is not affected by this problem. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2230-1 CVE-2011-0011 CVE-2011-1750 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 6.0 Debian GNU/kFreeBSD 6.0 | Product(s): | qemu-kvm |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:14005 | |||
| Oval ID: | oval:org.mitre.oval:def:14005 | ||
| Title: | USN-1145-1 -- qemu-kvm vulnerabilities | ||
| Description: | qemu-kvm: Machine emulator and virtualizer a privileged attacker within a QEMU guest could cause QEMU to crash. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-1145-1 CVE-2011-1750 CVE-2011-1751 | Version: | 5 |
| Platform(s): | Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 | Product(s): | qemu-kvm |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:21922 | |||
| Oval ID: | oval:org.mitre.oval:def:21922 | ||
| Title: | RHSA-2011:0534: qemu-kvm security, bug fix, and enhancement update (Important) | ||
| Description: | The pciej_write function in hw/acpi_piix4.c in the PIIX4 Power Management emulation in qemu-kvm does not check if a device is hotpluggable before unplugging the PCI-ISA bridge, which allows privileged guest users to cause a denial of service (guest crash) and possibly execute arbitrary code by sending a crafted value to the 0xae08 (PCI_EJ_BASE) I/O port, which leads to a use-after-free related to "active qemu timers." | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2011:0534-01 CVE-2011-1750 CVE-2011-1751 | Version: | 29 |
| Platform(s): | Red Hat Enterprise Linux 6 | Product(s): | qemu-kvm |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:22883 | |||
| Oval ID: | oval:org.mitre.oval:def:22883 | ||
| Title: | ELSA-2011:0534: qemu-kvm security, bug fix, and enhancement update (Important) | ||
| Description: | The pciej_write function in hw/acpi_piix4.c in the PIIX4 Power Management emulation in qemu-kvm does not check if a device is hotpluggable before unplugging the PCI-ISA bridge, which allows privileged guest users to cause a denial of service (guest crash) and possibly execute arbitrary code by sending a crafted value to the 0xae08 (PCI_EJ_BASE) I/O port, which leads to a use-after-free related to "active qemu timers." | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2011:0534-01 CVE-2011-1750 CVE-2011-1751 | Version: | 13 |
| Platform(s): | Oracle Linux 6 | Product(s): | qemu-kvm |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:27181 | |||
| Oval ID: | oval:org.mitre.oval:def:27181 | ||
| Title: | DEPRECATED: ELSA-2011-0534 -- qemu-kvm security, bug fix, and enhancement update (important) | ||
| Description: | It was found that the virtio-blk driver in qemu-kvm did not properly validate read and write requests from guests. A privileged guest user could use this flaw to crash the guest or, possibly, execute arbitrary code on the host. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2011-0534 CVE-2011-1750 CVE-2011-1751 | Version: | 4 |
| Platform(s): | Oracle Linux 6 | Product(s): | qemu-kvm |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2012-10-22 | Name : Gentoo Security Advisory GLSA 201210-04 (ebuild) File : nvt/glsa_201210_04.nasl |
| 2012-06-08 | Name : Fedora Update for qemu FEDORA-2012-8604 File : nvt/gb_fedora_2012_8604_qemu_fc15.nasl |
| 2012-06-06 | Name : RedHat Update for qemu-kvm RHSA-2011:0534-01 File : nvt/gb_RHSA-2011_0534-01_qemu-kvm.nasl |
| 2011-08-03 | Name : Debian Security Advisory DSA 2241-1 (qemu-kvm) File : nvt/deb_2241_1.nasl |
| 2011-06-20 | Name : Ubuntu Update for qemu-kvm USN-1145-1 File : nvt/gb_ubuntu_USN_1145_1.nasl |
| 2011-05-12 | Name : Debian Security Advisory DSA 2230-1 (qemu-kvm) File : nvt/deb_2230_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 73756 | KVM qemu-kvm hw/virtio-blk.c Multiple Function Local DoS |
| 73395 | Qemu PIIX4 Hotplug Invalid Memory Dereference Arbitrary Code Execution |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : suse_11_3_kvm-110518.nasl - Type : ACT_GATHER_INFO |
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : suse_11_4_kvm-110518.nasl - Type : ACT_GATHER_INFO |
| 2013-01-24 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2011-0534.nasl - Type : ACT_GATHER_INFO |
| 2012-10-19 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201210-04.nasl - Type : ACT_GATHER_INFO |
| 2012-08-01 | Name : The remote Scientific Linux host is missing one or more security updates. File : sl_20110519_qemu_kvm_on_SL6_x.nasl - Type : ACT_GATHER_INFO |
| 2012-06-08 | Name : The remote Fedora host is missing a security update. File : fedora_2012-8604.nasl - Type : ACT_GATHER_INFO |
| 2011-06-13 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1145-1.nasl - Type : ACT_GATHER_INFO |
| 2011-06-10 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2241.nasl - Type : ACT_GATHER_INFO |
| 2011-05-25 | Name : The remote SuSE 11 host is missing a security update. File : suse_11_kvm-110518.nasl - Type : ACT_GATHER_INFO |
| 2011-05-02 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2230.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:58:40 |
|
