CVE-2019-12929

QEMU's Machine Protocol QMP is designed to enable remote applications ex. Libvirt to control and manage QEMU process instances. QEMU Guest-Agent is a daemon program which helps remote applications ex. Libvirt to run commands on the guest VM, it supports QMP commands. It is meant to be used by...

CVE-2019-12929: Improper Neutralization of Special Elements used in an OS Command

The QMP guestexec command in QEMU 4.0.0 and earlier is prone to OS command injection, which allows the attacker to achieve code execution, denial of service, or information disclosure by sending a crafted QMP command to the listening server. Note: This has been disputed as a non-issue since QEMU'...