7.2 High
CVSS2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:L/AC:L/Au:N/C:C/I:C/A:C
0.001 Low
EPSS
Percentile
28.0%
Multiple vulnerabilities have been discovered in xen-qemu-dm-4.0, the Xen
QEMU Device Model virtual machine hardware emulator. The Common
Vulnerabilities and Exposures project identifies the following problems:
The device model for HVM domains does not properly handle VT100
escape sequences when emulating certain devices with a virtual
console backend. An attacker within a guest with access to the
vulnerable virtual console could overwrite memory of the device
model and escalate privileges to that of the device model process.
The QEMU monitor was enabled by default, allowing administrators of
a guest to access resources of the host, possibly escalate privileges
or access resources belonging to another guest.
For the stable distribution (squeeze), these problems have been fixed in
version 4.0.1-2+squeeze2.
The testing distribution (wheezy), and the unstable distribution (sid),
no longer contain this package.
We recommend that you upgrade your xen-qemu-dm-4.0 packages.
CPE | Name | Operator | Version |
---|---|---|---|
xen-qemu-dm-4.0 | eq | 4.0.1-2 | |
xen-qemu-dm-4.0 | eq | 4.0.1-2+squeeze1 |