2579 matches found
FreeBSD : qemu -- denial of service vulnerability in Rocker switch emulation (1384f2fd-b1be-11e5-9728-002590263bf5)
Prasad J Pandit, Red Hat Product Security Team, reports : Qemu emulator built with the Rocker switch emulation support is vulnerable to an off-by-one error. It happens while processing transmittx descriptors in 'txconsume' routine, if a descriptor was to have more than allowed ROCKERTXFRAGSMAX=16...
FreeBSD : qemu -- denial of service vulnerability in Q35 chipset emulation (152acff3-b1bd-11e5-9728-002590263bf5)
Prasad J Pandit, Red Hat Product Security Team, reports : Qemu emulator built with the Q35 chipset based pc system emulator is vulnerable to a heap based buffer overflow. It occurs during VM guest migration, as more16 bytes data is moved into allocated 8 bytes memory area. A privileged guest user...
FreeBSD : qemu -- denial of service vulnerability in MegaRAID SAS HBA emulation (b3f9f8ef-b1bb-11e5-9728-002590263bf5)
Prasad J Pandit, Red Hat Product Security Team, reports : Qemu emulator built with the SCSI MegaRAID SAS HBA emulation support is vulnerable to a stack-based buffer overflow issue. It occurs while processing the SCSI controller's CTRLGETINFO command. A privileged guest user could use this flaw to...
UBUNTU-CVE-2015-8613
Stack-based buffer overflow in the megasasctrlgetinfo function in QEMU, when built with SCSI MegaRAID SAS HBA emulation support, allows local guest users to cause a denial of service QEMU instance crash via a crafted SCSI controller CTRLGETINFO command...
[SECURITY] Fedora 22 Update: qemu-2.3.1-9.fc22
QEMU is a generic and open source processor emulator which achieves a good emulation speed by using dynamic translation. QEMU has two operating modes: Full system emulation. In this mode, QEMU emulates a full system for example a PC, including a processor and various peripherials. It can be used ...
qemu -- denial of service vulnerability in Rocker switch emulation
Prasad J Pandit, Red Hat Product Security Team, reports: Qemu emulator built with the Rocker switch emulation support is vulnerable to an off-by-one error. It happens while processing transmittx descriptors in 'txconsume' routine, if a descriptor was to have more than allowed ROCKERTXFRAGSMAX=16...
Qemu: net: pcnet: buffer overflow in non-loopback mode
A buffer overflow flaw was found in the way QEMU's AMD PC-Net II emulation validated certain received packets from a remote host in non-loopback mode. A remote, unprivileged attacker could potentially use this flaw to execute arbitrary code on the host with the privileges of the QEMU process. Not...
Qemu: net: pcnet: heap overflow vulnerability in pcnet_receive
A heap-based buffer overflow flaw was discovered in the way QEMU's AMD PC-Net II Ethernet Controller emulation received certain packets in loopback mode. A privileged user with the CAPSYSRAWIO capability inside a guest could use this flaw to crash the host QEMU process resulting in denial of...
Qemu: net: pcnet: buffer overflow in non-loopback mode
A buffer overflow flaw was found in the way QEMU's AMD PC-Net II emulation validated certain received packets from a remote host in non-loopback mode. A remote, unprivileged attacker could potentially use this flaw to execute arbitrary code on the host with the privileges of the QEMU process. Not...
Important: Red Hat Security Advisory: qemu-kvm-rhev security update
Updated qemu-kvm-rhev packages that fix two security issues are now available for Red Hat Enterprise Virtualization. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are...
Qemu: net: pcnet: heap overflow vulnerability in pcnet_receive
A heap-based buffer overflow flaw was discovered in the way QEMU's AMD PC-Net II Ethernet Controller emulation received certain packets in loopback mode. A privileged user with the CAPSYSRAWIO capability inside a guest could use this flaw to crash the host QEMU process resulting in denial of...
[SECURITY] Fedora 23 Update: qemu-2.4.1-2.fc23
QEMU is a generic and open source processor emulator which achieves a good emulation speed by using dynamic translation. QEMU has two operating modes: Full system emulation. In this mode, QEMU emulates a full system for example a PC, including a processor and various peripherials. It can be used ...
[SECURITY] Fedora 23 Update: qemu-2.4.1-3.fc23
QEMU is a generic and open source processor emulator which achieves a good emulation speed by using dynamic translation. QEMU has two operating modes: Full system emulation. In this mode, QEMU emulates a full system for example a PC, including a processor and various peripherials. It can be used ...
qemu -- denial of service vulnerability in USB EHCI emulation support
Prasad J Pandit, Red Hat Product Security Team, reports: Qemu emulator built with the USB EHCI emulation support is vulnerable to an infinite loop issue. It occurs during communication between host controller interfaceEHCI and a respective device driver. These two communicate via a isochronous...
RHEL 7 : kernel (RHSA-2015:2152)
The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:2152 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. A flaw was found in the way the Linux kernel's file...
kernel: kvm: insufficient sysenter emulation when invoked from 16-bit code
It was found that the Linux kernel KVM subsystem's sysenter instruction emulation was not sufficient. An unprivileged guest user could use this flaw to escalate their privileges by tricking the hypervisor to emulate a SYSENTER instruction in 16-bit mode, if the guest OS did not initialize the...
kernel: kvm: reporting emulation failures to userspace
It was found that reporting emulation failures to user space could lead to either a local CVE-2014-7842 or a L2-L1 CVE-2010-5313 denial of service. In the case of a local denial of service, an attacker must have access to the MMIO area or be able to access an I/O port. Please note that on certain...
kernel: kvm: reporting emulation failures to userspace
It was found that reporting emulation failures to user space could lead to either a local CVE-2014-7842 or a L2-L1 CVE-2010-5313 denial of service. In the case of a local denial of service, an attacker must have access to the MMIO area or be able to access an I/O port. Please note that on certain...
kernel: kvm: noncanonical rip after emulation
A flaw was found in the way the Linux kernel's KVM subsystem handled non-canonical addresses when emulating instructions that change the RIP for example, branches or calls. A guest user with access to an I/O or MMIO region could use this flaw to crash the guest...
