PT-2010-2198 · Red Hat · Qemu-Kvm+3

Izik Eidus + 1 · Publicado 2010-08-19 · Atualizado 2010-08-25 · CVE-2010-0431

Positive Technologies (AI Summary)

CVSS v2.0

6.6

Média

Vetor base

AV:L/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Red Hat Enterprise Virtualization (RHEV) version 2.2 KVM version 83

Description The issue is related to the QEMU-KVM component in the Hypervisor, which does not properly validate guest QXL driver pointers. This can allow guest OS users to cause a denial of service, resulting in an invalid pointer dereference and a guest OS crash. It is also possible for attackers to gain privileges via unspecified vectors.

Recommendations For Red Hat Enterprise Virtualization (RHEV) version 2.2, update the QEMU-KVM component to a version that properly validates guest QXL driver pointers. For KVM version 83, update the QEMU-KVM component to a version that properly validates guest QXL driver pointers.

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2010-0431

RHSA-2010:0622

RHSA-2010:0627

RHSA-2010_0627

Produtos afetados

Kvm

Qemu-Kvm

Red Hat

Red Hat Enterprise Virtualization

Referências · 8

• https://rhn.redhat.com/errata/RHSA-2010-0627.html · Aviso do Fabricante
• https://bugzilla.redhat.com/show_bug.cgi?id=568809 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2010:0627 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-0431 · Nota de Segurança
• https://rhn.redhat.com/errata/RHSA-2010-0622.html · Aviso do Fabricante
• https://access.redhat.com/security/cve/CVE-2010-0435 · Nota
• https://access.redhat.com/security/cve/CVE-2010-2784 · Nota
• https://access.redhat.com/security/cve/CVE-2010-0431 · Nota