CVE-2013-2016
EUVD-2013-200530.12.2019, 22:15
A flaw was found in the way qemu v1.3.0 and later (virtio-rng) validates addresses when guest accesses the config space of a virtio device. If the virtio device has zero/small sized config space, such as virtio-rng, a privileged guest user could use this flaw to access the matching host's qemu address space and thus increase their privileges on the host.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| qemu | qemu | 1.3.0 ≤ 𝑥 ≤ 1.4.2 |
| qemu | qemu | 1.5.0:rc1 |
| debian | debian_linux | 8.0 |
| debian | debian_linux | 9.0 |
| debian | debian_linux | 10.0 |
| novell | open_desktop_server | 11.0:sp3 |
| novell | open_enterprise_server | 11.0:sp3 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Ubuntu Product | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| kvm |
| ||||||||||||||
| qemu |
| ||||||||||||||
| qemu-kvm |
| ||||||||||||||
| xen-3.1 |
| ||||||||||||||
| xen-3.2 |
| ||||||||||||||
| xen-3.3 |
|
Common Weakness Enumeration
References