PT-2013-4982 · Qemu · Qemu

Sibiao Luo · Published 2013-10-11 · Updated 2014-03-06 · CVE-2013-4377

Positive Technologies (AI Summary)

CVSS v2.0

2.3

Low

Base vector

AV:A/AC:M/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Qemu versions 1.4.0 through 1.6.0

Description A use-after-free issue in the virtio-pci implementation allows local users to cause a denial of service by "hot-unplugging" a virtio device, resulting in a daemon crash.

Recommendations For Qemu versions 1.4.0 through 1.6.0, consider disabling the hot-unplug feature for virtio devices until a patch is available.

Fix

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2013-4377

MGASA-2014-0060

Affected Products

Qemu

References · 14

• http://ubuntu.com/usn/USN-2092-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-4377 · Security Note
• https://osv.dev/vulnerability/CVE-2013-4377 · Vendor Advisory
• http://lists.nongnu.org/archive/html/qemu-devel/2013-09/msg03347.html · Patch
• https://osv.dev/vulnerability/MGASA-2014-0060 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-4377 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2014-0060.html · Security Note
• http://secunia.com/advisories/55015 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2013-4377 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1012633 · Note
• https://bugs.mageia.org/show_bug.cgi?id=12494 · Note
• http://lists.nongnu.org/archive/html/qemu-stable/2013-12/msg00148.html · Note
• http://openwall.com/lists/oss-security/2013/09/26/5 · Note
• http://ubuntu.com/usn/usn-2092-1 · Note