PT-2017-1611 · Qemu+1 · Qemu+1

Zx2C4 · Published 2015-12-21 · Updated 2017-03-27 · CVE-2015-8556

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions QEMU versions prior to 2.5.0-r1 Gentoo QEMU package before 2.5.0-r1

Description The issue is caused by synchronization errors when using a shared resource in the QEMU hardware emulator. Exploitation of this issue may allow a remote attacker to cause a denial of service or elevate privileges in the guest operating system.

Recommendations For QEMU versions prior to 2.5.0-r1, update to version 2.5.0-r1 or later to resolve the issue. For the Gentoo QEMU package before 2.5.0-r1, update to version 2.5.0-r1 or later to resolve the issue.

Exploit

Fix

LPE

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

ALT-PU-2015-2158

BDU:2017-00757

CVE-2015-8556

Affected Products

Alt Linux

Qemu

References · 21

• 🔥 http://packetstormsecurity.com/files/134948/Gentoo-QEMU-Local-Privilege-Escalation.html · Exploit
• 🔥 https://security.gentoo.org/glsa/201602-01 · Exploit
• 🔥 https://exploit-db.com/exploits/39010 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8504 · Security Note
• https://bdu.fstec.ru/vul/2017-01030 · Security Note
• https://bdu.fstec.ru/vul/2016-00272 · Security Note
• https://bdu.fstec.ru/vul/2017-00757 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8745 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7549 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7295 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6855 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8345 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7504 · Security Note
• https://errata.altlinux.org/ALT-PU-2015-2158 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8666 · Security Note