PT-2019-6087 · Qemu+2 · Qemu+2

Published 2019-02-21 · Updated 2024-06-15 · CVE-2019-8934

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions QEMU versions prior to 3.1.0

Description The issue is related to information exposure due to the hypervisor sharing system attributes with a guest, specifically the /proc/device-tree/system-id and /proc/device-tree/model. This is caused by insufficient access control to ports in the hw/ppc/spapr.c component of the QEMU emulator. Exploitation of this issue may allow an attacker to access confidential data.

Recommendations For QEMU versions prior to 3.1.0, update to version 3.1.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the /proc/device-tree/system-id and /proc/device-tree/model system attributes to minimize the risk of exploitation.

Exploit

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

ALT-PU-2019-1973

ALT-PU-2019-1990

BDU:2021-05174

CVE-2019-8934

OPENSUSE-SU-2019:1405-1

OPENSUSE-SU-2019_1274-1

OPENSUSE-SU-2019_1405-1

OPENSUSE-SU-2024:11287-1

SUSE-SU-2019:1238-1

SUSE-SU-2019:1239-1

SUSE-SU-2021:1829-1

Affected Products

Alt Linux

Qemu

Suse

References · 232

• 🔥 https://lists.gnu.org/archive/html/qemu-devel/2019-02/msg04821.html · Exploit
• https://linux.oracle.com/errata/ELSA-2019-4640.html · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-8934 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-12130 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20124 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20125 · Security Note
• http://openwall.com/lists/oss-security/2019/02/21/1 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2021:1829-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-03199 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2019-8934 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8934 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20216 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-8934 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-8934 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20126 · Security Note