PT-2012-1530 · Qemu+1 · Qemu-Kvm+1
Conor Murphy
·
Publicado
2011-05-19
·
Atualizado
2023-02-13
·
CVE-2011-1750
CVSS v2.0
7.4
Alta
| Vetor | AV:A/AC:M/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
qemu-kvm version 0.14.0
Description
The issue is related to multiple heap-based buffer overflows in the virtio-blk driver. This can be exploited by local guest users to cause a denial of service, potentially leading to a guest crash, and may also allow them to gain privileges. The exploitation can occur through a write request to the
virtio blk handle write function or a read request to the virtio blk handle read function that is not properly aligned.Recommendations
For qemu-kvm version 0.14.0, consider updating to a newer version that addresses the buffer overflow issues in the virtio-blk driver. As a temporary workaround, restrict access to the
virtio blk handle write and virtio blk handle read functions to minimize the risk of exploitation.Correção
DoS
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Red Hat
Qemu-Kvm