qemu: buffer overflow in scsi_target_emulate_report_luns

🗓️ 21 Nov 2013 04:40:00Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 4 Views

QEMU SCSI REPORT LUNS overflow in Xen when more than 256 devices allows local privilege gain.

Reporter	Title	Published	Views	Family All 80
BDU FSTEC	The vulnerability of the SUSE Linux Enterprise operating system allows attackers to compromise the confidentiality, integrity, and accessibility of protected information.	28 Apr 201500:00	–	bdu_fstec
Tenable Nessus	CentOS 6 : qemu-kvm (CESA-2013:1553)	12 Nov 201400:00	–	nessus
Tenable Nessus	Debian DSA-2932-1 : qemu - security update	20 May 201400:00	–	nessus
Tenable Nessus	Debian DSA-2933-1 : qemu-kvm - security update	20 May 201400:00	–	nessus
Tenable Nessus	Fedora 19 : qemu-1.4.2-12.fc19 (2013-18493)	15 Oct 201300:00	–	nessus
Tenable Nessus	Fedora 20 : qemu-1.6.0-10.fc20 (2013-18715)	15 Oct 201300:00	–	nessus
Tenable Nessus	MiracleLinux 4 : qemu-kvm-0.12.1.2-2.415.AXS4.4 (AXSA:2014-016:01)	16 Jan 202600:00	–	nessus
Tenable Nessus	openSUSE Security Update : qemu (openSUSE-SU-2014:0200-1)	13 Jun 201400:00	–	nessus
Tenable Nessus	openSUSE Security Update : xen (openSUSE-SU-2014:1279-1)	10 Oct 201400:00	–	nessus
Tenable Nessus	openSUSE Security Update : xen (openSUSE-SU-2014:1281-1)	10 Oct 201400:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	6	any	rhev-hypervisor6	0:6.5-20131115.0.3.2.el6_5.noarch	rhev-hypervisor6-0:6.5-20131115.0.3.2.el6_5.noarch.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2013-4344
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
nvd	www.nvd.nist.gov/vuln/detail/CVE-2013-4344
cve	www.cve.org/CVERecord

27 Jun 2026 12:14Current

7.3High risk

Vulners AI Score7.3

CVSS 27.2

EPSS0.00434

Qemu Report logical units Buffer overflow Privilege escalation Xen Device limit