PT-2019-6087 · Qemu+2 · Qemu+2

Publicado

2019-02-21

·

Atualizado

2024-06-15

·

CVE-2019-8934

CVSS v3.1

3.3

Baixa

VetorAV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Name of the Vulnerable Software and Affected Versions QEMU versions prior to 3.1.0
Description The issue is related to information exposure due to the hypervisor sharing system attributes with a guest, specifically the /proc/device-tree/system-id and /proc/device-tree/model. This is caused by insufficient access control to ports in the hw/ppc/spapr.c component of the QEMU emulator. Exploitation of this issue may allow an attacker to access confidential data.
Recommendations For QEMU versions prior to 3.1.0, update to version 3.1.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the /proc/device-tree/system-id and /proc/device-tree/model system attributes to minimize the risk of exploitation.

Exploit

Correção

Exposure of Resource to Wrong Sphere

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-668

Identificadores relacionados

ALT-PU-2019-1973
ALT-PU-2019-1990
BDU:2021-05174
CVE-2019-8934
OPENSUSE-SU-2019:1405-1
OPENSUSE-SU-2019_1274-1
OPENSUSE-SU-2019_1405-1
OPENSUSE-SU-2024:11287-1
SUSE-SU-2019:1238-1
SUSE-SU-2019:1239-1
SUSE-SU-2021:1829-1

Produtos afetados

Alt Linux
Qemu
Suse