Executive Summary
| Summary | |
|---|---|
| Title | QEMU vulnerabilities |
| Informations | |||
|---|---|---|---|
| Name | USN-1165-1 | First vendor Publication | 2011-07-06 |
| Vendor | Ubuntu | Last vendor Modification | 2011-07-06 |
| Severity (Vendor) | N/A | Revision | N/A |
Security-Database Scoring CVSS v3
| Cvss vector : N/A | |||
|---|---|---|---|
| Overall CVSS Score | NA | ||
| Base Score | NA | Environmental Score | NA |
| impact SubScore | NA | Temporal Score | NA |
| Exploitabality Sub Score | NA | ||
| Calculate full CVSS 3.0 Vectors scores | |||
Security-Database Scoring CVSS v2
| Cvss vector : (AV:A/AC:M/Au:S/C:C/I:C/A:C) | |||
|---|---|---|---|
| Cvss Base Score | 7.4 | Attack Range | Adjacent network |
| Cvss Impact Score | 10 | Attack Complexity | Medium |
| Cvss Expoit Score | 4.4 | Authentication | Requires single instance |
| Calculate full CVSS 2.0 Vectors scores | |||
Detail
| A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 11.04 - Ubuntu 10.10 - Ubuntu 10.04 LTS Summary: A privileged attacker within a QEMU guest could cause QEMU to crash. Software Description: - qemu-kvm: Machine emulator and virtualizer Details: Nelson Elhage discoverd that QEMU did not properly validate certain virtqueue requests from the guest. An attacker could exploit this to cause a denial of service of the guest or possibly execute code with the privileges of the user invoking the program. (CVE-2011-2212) Stefan Hajnoczi discovered that QEMU did not properly perform integer comparisons when performing virtqueue input validation. An attacker could exploit this to cause a denial of service of the guest or possibly execute code with the privileges of the user invoking the program. (CVE-2011-2512) When using QEMU with libvirt or virtualization management software based on libvirt such as Eucalyptus and OpenStack, QEMU guests are individually isolated by an AppArmor profile by default in Ubuntu. Update instructions: The problem can be corrected by updating your system to the following package versions: Ubuntu 11.04: Ubuntu 10.10: Ubuntu 10.04 LTS: After a standard system update you need to restart running virtual machines to make all the necessary changes. References: Package Information: |
Original Source
| Url : http://www.ubuntu.com/usn/USN-1165-1 |
CWE : Common Weakness Enumeration
| % | Id | Name |
|---|---|---|
| 50 % | CWE-119 | Failure to Constrain Operations within the Bounds of a Memory Buffer |
| 50 % | CWE-20 | Improper Input Validation |
OVAL Definitions
| Definition Id: oval:org.mitre.oval:def:12421 | |||
| Oval ID: | oval:org.mitre.oval:def:12421 | ||
| Title: | DSA-2270-1 qemu-kvm -- programming error | ||
| Description: | It was discovered that incorrect sanitising of virtio queue commands in KVM, a solution for full virtualization on x86 hardware, could lead to denial of service of the execution of arbitrary code. The oldstable distribution is not affected by this problem. | ||
| Family: | unix | Class: | patch |
| Reference(s): | DSA-2270-1 CVE-2011-2512 | Version: | 5 |
| Platform(s): | Debian GNU/Linux 6.0 Debian GNU/kFreeBSD 6.0 | Product(s): | qemu-kvm |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:13974 | |||
| Oval ID: | oval:org.mitre.oval:def:13974 | ||
| Title: | USN-1165-1 -- qemu-kvm vulnerabilities | ||
| Description: | qemu-kvm: Machine emulator and virtualizer A privileged attacker within a QEMU guest could cause QEMU to crash. | ||
| Family: | unix | Class: | patch |
| Reference(s): | USN-1165-1 CVE-2011-2212 CVE-2011-2512 | Version: | 5 |
| Platform(s): | Ubuntu 11.04 Ubuntu 10.04 Ubuntu 10.10 | Product(s): | qemu-kvm |
| Definition Synopsis: | |||
| |||
| Definition Id: oval:org.mitre.oval:def:22055 | |||
| Oval ID: | oval:org.mitre.oval:def:22055 | ||
| Title: | RHSA-2011:0919: qemu-kvm security and bug fix update (Important) | ||
| Description: | The virtio_queue_notify in qemu-kvm 0.14.0 and earlier does not properly validate the virtqueue number, which allows guest users to cause a denial of service (guest crash) and possibly execute arbitrary code via a negative number in the Queue Notify field of the Virtio Header, which bypasses a signed comparison. | ||
| Family: | unix | Class: | patch |
| Reference(s): | RHSA-2011:0919-01 CVE-2011-2212 CVE-2011-2512 | Version: | 29 |
| Platform(s): | Red Hat Enterprise Linux 6 | Product(s): | qemu-kvm |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:23582 | |||
| Oval ID: | oval:org.mitre.oval:def:23582 | ||
| Title: | ELSA-2011:0919: qemu-kvm security and bug fix update (Important) | ||
| Description: | The virtio_queue_notify in qemu-kvm 0.14.0 and earlier does not properly validate the virtqueue number, which allows guest users to cause a denial of service (guest crash) and possibly execute arbitrary code via a negative number in the Queue Notify field of the Virtio Header, which bypasses a signed comparison. | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2011:0919-01 CVE-2011-2212 CVE-2011-2512 | Version: | 13 |
| Platform(s): | Oracle Linux 6 | Product(s): | qemu-kvm |
| Definition Synopsis: | |||
| Definition Id: oval:org.mitre.oval:def:28000 | |||
| Oval ID: | oval:org.mitre.oval:def:28000 | ||
| Title: | DEPRECATED: ELSA-2011-0919 -- qemu-kvm security and bug fix update (important) | ||
| Description: | [qemu-kvm-0.12.1.2-2.160.el6_1.2] - kvm-virtio-guard-against-negative-vq-notifies.patch [bz#717403] - Resolves: bz#717403 (qemu-kvm: OOB memory access caused by negative vq notifies [rhel-6.1.z]) [qemu-kvm-0.12.1.2-2.160.el6_1] - kvm-Fix-phys-memory-client-pass-guest-physical-address-n.patch [bz#701771] - kvm-virtio-prevent-indirect-descriptor-buffer-overflow.patch [bz#713592] - Resolves: bz#701771 (Fix phys memory client for vhost) - Resolves: bz#713592 (EMBARGOED CVE-2011-2212 virtqueue: too-large indirect descriptor buffer overflow [rhel-6.1.z]) | ||
| Family: | unix | Class: | patch |
| Reference(s): | ELSA-2011-0919 CVE-2011-2212 CVE-2011-2512 | Version: | 4 |
| Platform(s): | Oracle Linux 6 | Product(s): | qemu-kvm |
| Definition Synopsis: | |||
CPE : Common Platform Enumeration
OpenVAS Exploits
| Date | Description |
|---|---|
| 2012-10-22 | Name : Gentoo Security Advisory GLSA 201210-04 (ebuild) File : nvt/glsa_201210_04.nasl |
| 2012-06-06 | Name : RedHat Update for qemu-kvm RHSA-2011:0919-01 File : nvt/gb_RHSA-2011_0919-01_qemu-kvm.nasl |
| 2011-08-07 | Name : Debian Security Advisory DSA 2282-1 (qemu-kvm) File : nvt/deb_2282_1.nasl |
| 2011-08-03 | Name : Debian Security Advisory DSA 2270-1 (qemu-kvm) File : nvt/deb_2270_1.nasl |
| 2011-07-08 | Name : Ubuntu Update for qemu-kvm USN-1165-1 File : nvt/gb_ubuntu_USN_1165_1.nasl |
Open Source Vulnerability Database (OSVDB)
| Id | Description |
|---|---|
| 74751 | KVM qemu-kvm VirtIO Queue Notification Local Privilege Escalation |
| 73618 | Qemu VirtIO virtqueue Request Parsing Local Overflow |
Nessus® Vulnerability Scanner
| Date | Description |
|---|---|
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : suse_11_3_kvm-110711.nasl - Type : ACT_GATHER_INFO |
| 2014-06-13 | Name : The remote openSUSE host is missing a security update. File : suse_11_4_kvm-110711.nasl - Type : ACT_GATHER_INFO |
| 2013-07-12 | Name : The remote Oracle Linux host is missing one or more security updates. File : oraclelinux_ELSA-2011-0919.nasl - Type : ACT_GATHER_INFO |
| 2013-01-24 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2011-0919.nasl - Type : ACT_GATHER_INFO |
| 2012-10-19 | Name : The remote Gentoo host is missing one or more security-related patches. File : gentoo_GLSA-201210-04.nasl - Type : ACT_GATHER_INFO |
| 2011-07-26 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2282.nasl - Type : ACT_GATHER_INFO |
| 2011-07-19 | Name : The remote SuSE 11 host is missing a security update. File : suse_11_kvm-110630.nasl - Type : ACT_GATHER_INFO |
| 2011-07-07 | Name : The remote Ubuntu host is missing one or more security-related patches. File : ubuntu_USN-1165-1.nasl - Type : ACT_GATHER_INFO |
| 2011-07-05 | Name : The remote Debian host is missing a security-related update. File : debian_DSA-2270.nasl - Type : ACT_GATHER_INFO |
Alert History
| Date | Informations |
|---|---|
| 2014-02-17 11:58:46 |
|
