PT-2008-2542 · Qemu+1 · Qemu+1

Ian Jackson · Published 2008-03-03 · Updated 2024-06-15 · CVE-2008-0928

Positive Technologies (AI Summary)

CVSS v2.0

4.7

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Qemu versions 0.9.1 and earlier

Description The issue allows guest host users with root privileges to access arbitrary memory and escape the virtual machine due to a lack of range checks for block device read or write requests.

Recommendations For Qemu versions 0.9.1 and earlier, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-0928

DSA-1799-1

DTSA-133-1

OPENSUSE-SU-2024:10233-1

OPENSUSE-SU-2024:10285-1

RHSA-2008:0194

RHSA-2008_0194

Affected Products

Qemu

Red Hat

References · 89

• http://redhat.com/support/errata/RHSA-2008-0194.html · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-February/msg00900.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2008-0928 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-0928 · Security Note
• http://secunia.com/advisories/29172 · Vendor Advisory
• http://redhat.com/archives/fedora-package-announce/2008-February/msg00830.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-0928 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10233-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2008-0928 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2008:162 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10285-1 · Vendor Advisory
• http://debian.org/security/2009/dsa-1799 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2009:016 · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-February/msg00852.html · Vendor Advisory