PT-2013-3472 · Xen+1 · Qemu+1

Daniel Berrange · Published 2013-05-13 · Updated 2024-06-15 · CVE-2013-1922

Positive Technologies (AI Summary)

CVSS v2.0

3.3

Low

Base vector

AV:L/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions QEMU versions used in Xen 4.2.x

Description The issue allows local guest OS administrators to read arbitrary files on the host by modifying the header of a raw disk image to identify a different format. This is exploited when the guest is restarted.

Recommendations For QEMU versions used in Xen 4.2.x, consider restricting access to the raw disk image functionality to minimize the risk of exploitation until a fix is available.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2013-1922

OPENSUSE-SU-2024:10196-1

SUSE-SU-2013_1923-1

Affected Products

Qemu

Suse

References · 166

• https://osv.dev/vulnerability/openSUSE-SU-2024:10196-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2007 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103621.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4494 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1922 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4554 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-1922 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4375 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2013-1922 · Security Note
• http://lists.fedoraproject.org/pipermail/package-announce/2013-April/103637.html · Vendor Advisory
• http://security.gentoo.org/glsa/glsa-201309-24.xml · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2013-April/104036.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4416 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4553 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2013-1922 · Vendor Advisory