PT-2015-1368 · Qemu+3 · Qemu+3

Jan Beulich · Published 2015-06-03 · Updated 2024-06-15 · CVE-2015-4106

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions QEMU (affected versions not specified)

Description The issue is related to insufficient access control in QEMU, which might allow a local attacker, using an x86 HVM guest, to gain privileges, cause a denial of service (host crash), obtain sensitive information, or have other unspecified impacts. The vulnerability is associated with the emulator's handling of PCI pass-through devices and their PCI config space.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Improper Access Control

Incorrect Authorization

Weakness Enumeration

CWE-284

CWE-863

Related Identifiers

ALT-PU-2015-1865

BDU:2015-10460

CVE-2015-4106

DSA-3284-1

DSA-3286-1

MGASA-2015-0310

MGASA-2016-0098

OPENSUSE-SU-2015_1092-1

OPENSUSE-SU-2015_1094-1

OPENSUSE-SU-2024:10196-1

SUSE-SU-2015:1042-1

SUSE-SU-2015:1045-1

SUSE-SU-2015:1156-1

SUSE-SU-2015:1157-1

SUSE-SU-2015:2324-1

USN-2630-1

Affected Products

Alt Linux

Qemu

Suse

Ubuntu

References · 321

• 🔥 https://github.com/vincentbernat/cve-2015-3456 · Exploit
• https://ubuntu.com/security/CVE-2015-4103 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10196-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2630-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-4164 · Security Note
• https://osv.dev/vulnerability/CVE-2015-4106 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160154.html · Vendor Advisory
• https://advisories.mageia.org/MGASA-2016-0098.html · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3209 · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2015-06/msg00030.html · Vendor Advisory
• https://osv.dev/vulnerability/USN-2630-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-3209 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-10460 · Security Note
• https://cve.org/CVERecord?id=CVE-2015-4106 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2015:2324-1 · Vendor Advisory