PT-2014-1284 · Qemu+5 · Qemu+5
Publicado
2014-04-18
·
Atualizado
2024-06-15
·
CVE-2014-0150
CVSS v2.0
4.9
Média
| Vetor | AV:A/AC:M/Au:S/C:P/I:P/A:P |
Name of the Vulnerable Software and Affected Versions
QEMU versions 2.0 and earlier
Description
The issue is related to an integer overflow in the
virtio net handle mac function, which can be triggered by a MAC addresses table update request. This leads to a heap-based buffer overflow, allowing local guest users to execute arbitrary code. The vulnerability can also cause a denial of service or allow users to disrupt the integrity of the host operating system's dynamic memory.Recommendations
For QEMU versions 2.0 and earlier, consider disabling the
virtio net handle mac function as a temporary workaround until a patch is available. Restrict access to the hw/net/virtio-net.c module to minimize the risk of exploitation. Avoid using the MAC addresses table update request in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability. Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Qemu
Red Hat
Suse
Ubuntu