PT-2012-1060 · Qemu+1 · Qemu-Kvm+1

Petr Matousek · Published 2011-07-05 · Updated 2023-02-13 · CVE-2011-2512

Positive Technologies (AI Summary)

CVSS v2.0

7.4

High

Base vector

AV:A/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions qemu-kvm version 0.14.0 and earlier

Description The issue allows guest users to cause a denial of service, potentially leading to a guest crash, and possibly execute arbitrary code. This is due to the virtio queue notify in qemu-kvm not properly validating the virtqueue number, which can be bypassed by a negative number in the Queue Notify field of the Virtio Header. Additionally, multiple vulnerabilities in the kvm package of the openSUSE operating system may lead to breaches of confidentiality, integrity, and availability of protected information, exploitable by an authenticated attacker.

Recommendations For qemu-kvm version 0.14.0 and earlier, consider updating to a newer version to mitigate the risk, as the current version does not properly validate the virtqueue number. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

RCE

Buffer Overflow

Weakness Enumeration

CWE-20

CWE-119

Related Identifiers

BDU:2015-05373

CVE-2011-2512

DSA-2270-1

RHSA-2011:0919

RHSA-2011_0919

Affected Products

Red Hat

Qemu-Kvm

References · 21

• 🔥 http://git.kernel.org/?p=virt/kvm/qemu-kvm.git;a=commitdiff;h=7157e2e23e89adcd436caeab31fdd6b47eded377 · Exploit
• http://secunia.com/advisories/44648 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2011-0919.html · Vendor Advisory
• http://ubuntu.com/usn/usn-1165-1 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00007.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2011-2512 · Security Note
• http://secunia.com/advisories/45301 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2011-0919.html · Vendor Advisory
• http://secunia.com/advisories/45158 · Vendor Advisory
• https://hermes.opensuse.org/messages/9605323 · Vendor Advisory
• http://openwall.com/lists/oss-security/2011/06/29/15 · Patch
• http://secunia.com/advisories/45170 · Vendor Advisory
• http://openwall.com/lists/oss-security/2011/06/28/13 · Patch
• https://bdu.fstec.ru/vul/2015-05373 · Security Note
• https://debian.org/security/2011/dsa-2270 · Vendor Advisory