PT-2010-2089 · Qemu+1 · Qemu+1

Published 2010-02-09 · Updated 2023-02-13 · CVE-2010-0297

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions QEMU versions prior to 0.11.1

Description A buffer overflow issue exists in the usb host handle control function within the USB passthrough handling implementation. This allows guest OS users to potentially cause a denial of service, such as crashing or hanging the guest OS, or possibly execute arbitrary code on the host OS by sending a crafted USB packet.

Recommendations For versions prior to 0.11.1, update to version 0.11.1 or later to resolve the issue. As a temporary workaround, consider restricting the use of USB passthrough functionality until a patch is applied.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2010-0297

RHSA-2010:0088

RHSA-2010:0172

RHSA-2010_0088

Affected Products

Qemu

Red Hat

References · 18

• https://nvd.nist.gov/vuln/detail/CVE-2010-0297 · Security Note
• https://rhn.redhat.com/errata/RHSA-2010-0088.html · Vendor Advisory
• http://wiki.qemu.org/ChangeLog · Note
• http://git.savannah.gnu.org/cgit/qemu.git/commit/?id=babd03fde68093482528010a5435c14ce9128e3f · Note
• https://access.redhat.com/errata/RHSA-2010:0088 · Note
• https://access.redhat.com/security/cve/CVE-2010-0297 · Note
• http://mail-archive.com/kvm%40vger.kernel.org/msg18447.html · Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11786 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/56194 · Note
• http://marc.info/?l=oss-security&m=126527304127254&w=2 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=557025 · Note
• https://access.redhat.com/security/cve/CVE-2010-0298 · Note
• https://access.redhat.com/security/cve/CVE-2010-0309 · Note
• https://access.redhat.com/security/cve/CVE-2010-0306 · Note
• http://mail-archive.com/kvm%40vger.kernel.org/msg19596.html · Note