PT-2007-2761 · Qemu · Qemu

Published 2007-05-02 · Updated 2024-06-15 · CVE-2007-1366

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions QEMU version 0.8.2

Description The issue allows local users to crash a virtual machine by utilizing the divisor operand to the aam instruction. This can be demonstrated by the instruction "aam 0x0," which triggers a divide-by-zero error.

Recommendations For QEMU version 0.8.2, consider applying a patch or update that fixes the divide-by-zero error triggered by the aam instruction. As a temporary workaround, restrict the use of the aam instruction with a divisor operand of 0 to minimize the risk of virtual machine crashes.

Fix

Related Identifiers

CVE-2007-1366

DSA-1284-1

DTSA-133-1

DTSA-38-1

OPENSUSE-SU-2024:11520-1

Affected Products

Qemu

References · 111

• https://osv.dev/vulnerability/DEBIAN-CVE-2007-1366 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2007-1366 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11520-1 · Vendor Advisory
• http://lists.gnu.org/archive/html/qemu-devel/2007-04/msg00651.html · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2007-1366 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2008:162 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2007-1366 · Vendor Advisory
• http://debian.org/security/2007/dsa-1284 · Vendor Advisory
• https://suse.com/security/cve/CVE-2020-15565 · Note
• http://vupen.com/english/advisories/2007/1597 · Note
• https://suse.com/security/cve/CVE-2020-11739 · Note
• https://suse.com/security/cve/CVE-2016-9384 · Note
• https://suse.com/security/cve/CVE-2016-9921 · Note
• https://suse.com/security/cve/CVE-2020-25600 · Note
• https://suse.com/security/cve/CVE-2016-10024 · Note