PT-2008-3525 · Qemu+1 · Qemu+1

Avi Kivity · Published 2008-05-12 · Updated 2017-09-29 · CVE-2008-2004

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:L/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions QEMU version 0.9.1

Description The issue allows local guest users to read arbitrary files on the host by modifying the header of a raw disk image to identify a different format. This is possible due to the drive init function in QEMU, which determines the format of a raw disk image based on the header. The modified header is used when the guest is restarted.

Recommendations For QEMU version 0.9.1, as a temporary workaround, consider restricting access to the drive init function until a patch is available. Additionally, avoid using the raw disk image feature with untrusted guests to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2008-2004

DTSA-133-1

RHSA-2008:0194

RHSA-2008_0194

Affected Products

Qemu

Red Hat

References · 25

• 🔥 http://lists.gnu.org/archive/html/qemu-devel/2008-04/msg00675.html · Exploit
• http://mandriva.com/security/advisories?name=MDVSA-2008:162 · Vendor Advisory
• http://ubuntu.com/usn/usn-776-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2008-2004 · Vendor Advisory
• http://secunia.com/advisories/30111 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2008-2004 · Vendor Advisory
• http://novell.com/linux/security/advisories/2008_13_sr.html · Vendor Advisory
• http://redhat.com/support/errata/RHSA-2008-0194.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-2004 · Security Note
• https://osv.dev/vulnerability/CVE-2008-2004 · Vendor Advisory
• https://access.redhat.com/security/cve/CVE-2007-5730 · Note
• https://access.redhat.com/errata/RHSA-2008:0194 · Note
• http://secunia.com/advisories/35062 · Note
• https://access.redhat.com/security/cve/CVE-2008-0928 · Note
• https://access.redhat.com/security/cve/CVE-2008-1943 · Note