Laszlo Ersek

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** A flaw was found in the Linux kernel's TUN/TAP functionality, which could allow a local user to bypass network filters and gain unauthorized access to some resources. The issue is related to the incorrect initialization of the socket UID in the `tun chr open()` and `tap open()` functions. This could potentially allow an attacker to impact data integrity or elevate their privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libguestfs (affected versions not specified) **Description** A flaw was found in the get keys() function, specifically when calculating the greatest possible number of matching keys. This issue can lead to a denial of service, which could be caused by either a mistake or a malicious actor. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: libslirp version 4.1.0 QEMU version 4.2.0 Description: The issue is related to a component of the Libslirp TCP-IP emulator, specifically the tcp subr.c library, which has an insufficient mechanism for checking the size of copied data. This allows a remote attacker to access confidential data, compromise its integrity, and cause a denial of service. The problem arises from the misuse of snprintf return values in the tcp subr.c file, leading to a buffer overflow in later code. Recommendations: For libslirp version 4.1.0, consider updating to a newer version that addresses the buffer overflow issue in the tcp subr.c library. For QEMU version 4.2.0, update to a version that includes the fix for the libslirp component to prevent exploitation of the buffer overflow vulnerability. As a temporary workaround, consider restricting access to the tcp subr.c component until a patch is available.

**Name of the Vulnerable Software and Affected Versions** QEMU (affected versions not specified) **Description** The issue is related to an infinite loop that could occur while processing data via transmit or receive descriptors in QEMU, specifically when the initial receive/transmit descriptor head is set outside the allocated descriptor buffer. A privileged user inside a guest could exploit this to crash the QEMU instance, resulting in a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** libcacard-devel versions 1.5.3 libcacard versions 1.5.3 libcacard-tools versions 1.5.3 QEMU (affected versions not specified) **Description** The issue affects the confidentiality, integrity, and availability of protected information. It can be exploited remotely. In QEMU, the VGA emulator allows local guest users to read host memory by setting the display to a high resolution. **Recommendations** For libcacard-devel version 1.5.3, update to a version that contains a fix for this issue. For libcacard version 1.5.3, update to a version that contains a fix for this issue. For libcacard-tools version 1.5.3, update to a version that contains a fix for this issue. For QEMU, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Qemu versions 1.4.1 and earlier **Description** The issue concerns the qemu guest agent in Qemu, which is used by Xen. When the agent is started in daemon mode, it utilizes weak permissions for certain files. This weakness allows local users to read and write to these files. **Recommendations** For Qemu versions 1.4.1 and earlier, consider restricting access to the affected files until a patch is available. As a temporary workaround, avoid running the qemu guest agent in daemon mode to minimize the risk of exploitation.