PT-2010-2196 · Red Hat · Red Hat Enterprise Virtualization+4

Published 2010-08-19 · Updated 2010-08-25 · CVE-2010-0428

Positive Technologies (AI Summary)

CVSS v2.0

6.6

Medium

Base vector

AV:L/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions libspice versions as used in QEMU-KVM in Red Hat Enterprise Virtualization (RHEV) 2.2 qspice version 0.3.0

Description The issue is related to the improper validation of guest QXL driver pointers in libspice, which can lead to a denial of service due to an invalid pointer dereference, causing the guest OS to crash. It is also possible for attackers to gain privileges via unspecified vectors.

Recommendations For libspice as used in QEMU-KVM in Red Hat Enterprise Virtualization (RHEV) 2.2, update to a version that properly validates guest QXL driver pointers. For qspice version 0.3.0, update to a version that properly validates guest QXL driver pointers. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2010-0428

RHSA-2010:0622

RHSA-2010:0633

RHSA-2010_0633

Affected Products

Qemu-Kvm

Red Hat

Red Hat Enterprise Virtualization

Libspice

Qspice

References · 7

• https://rhn.redhat.com/errata/RHSA-2010-0633.html · Vendor Advisory
• https://rhn.redhat.com/errata/RHSA-2010-0622.html · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=568699 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-0428 · Security Note
• https://access.redhat.com/security/cve/CVE-2010-0428 · Note
• https://access.redhat.com/security/cve/CVE-2010-0429 · Note
• https://access.redhat.com/errata/RHSA-2010:0633 · Note