Gentoo Linux Security Advisory 201210-4 - Multiple vulnerabilities were found in qemu-kvm, allowing attackers to execute arbitrary code. Versions less than 1.1.1-r1 are affected.
06a3dcc607829516f85c54a5f5e6c417bc1c799c5779cfc55ea88d07821757e1Debian Linux Security Advisory 2282-1 - Two vulnerabilities have been discovered in KVM, a solution for full virtualization on x86 hardware.
4fa44e9efca1c5b557bed9d0c7b29b0c56e7c7e66d15cbe2066edfaf181e51e0Ubuntu Security Notice 1165-1 - Nelson Elhage discovered that QEMU did not properly validate certain virtqueue requests from the guest. An attacker could exploit this to cause a denial of service of the guest or possibly execute code with the privileges of the user invoking the program. Stefan Hajnoczi discovered that QEMU did not properly perform integer comparisons when performing virtqueue input validation. An attacker could exploit this to cause a denial of service of the guest or possibly execute code with the privileges of the user invoking the program. Various other issues were also addressed.
e3ccd0d1153d4140f17f1e1ce0c2c4ba9f29570da645f067a3ba6f3b39a4acaaRed Hat Security Advisory 2011-0919-01 - KVM is a full virtualization solution for Linux on AMD64 and Intel 64 systems. qemu-kvm is the user-space component for running virtual machines using KVM. It was found that the virtio subsystem in qemu-kvm did not properly validate virtqueue in and out requests from the guest. A privileged guest user could use this flaw to trigger a buffer overflow, allowing them to crash the guest or, possibly, escalate their privileges on the host. It was found that the virtio_queue_notify() function in qemu-kvm did not perform sufficient input validation on the value later used as an index into the array of virtqueues. An unprivileged guest user could use this flaw to crash the guest or, possibly, escalate their privileges on the host. Various other issues were also addressed.
618f288e12fbda5483a5747741cf28e456411a05c89f0f05dca002132c56c20b
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed