Arbitrary Code Execution

qemu-kvm is vulnerable to arbitrary code execution. The vulnerability exists as it was found that the PIIX4 Power Management emulation layer in qemu-kvm did not properly check for hot plug eligibility during device removals. A privileged guest user could use this flaw to crash the guest or,...

Arbitrary Code Execution

qemu-kvm is vulnerable to arbitrary code execution. The vulnerability exists as it was found that the virtio-blk driver in qemu-kvm did not properly validate read and write requests from guests. A privileged guest user could use this flaw to crash the guest or, possibly, execute arbitrary code on...

Privilege Escalation

qemu-kvm is vulnerable to privilege escalation. The vulnerability exists as it was found that the virtioqueuenotify function in qemu-kvm did not perform sufficient input validation on the value later used as an index into the array of virtqueues. An unprivileged guest user could use this flaw to...

Privilege Escalation

qemu-kvm is vulnerable to privilege escalation. The vulnerability exists as it was found that the virtio subsystem in qemu-kvm did not properly validate virtqueue in and out requests from the guest. A privileged guest user could use this flaw to trigger a buffer overflow, allowing them to crash t...

Privilege Escalation

kvm is vulnerable to privilege escalation. The vulnerability exists as a flaw was found in QEMU-KVM, allowing the guest some control over the index used to access the callback array during sub-page MMIO initialization. A privileged guest user could use this flaw to crash the guest denial of servi...

Denial Of Service (DoS)

kvm is vulnerable to denial of service DoS. The vulnerability exists as a NULL pointer dereference flaw was found when the host system had a processor with the Intel VT-x extension enabled. A privileged guest user could use this flaw to trick the host into emulating a certain instruction...

Privilege Escalation

kvm is vulnerable to privilege escalation. The vulnerability exists as it was found that QEMU-KVM on the host did not validate all pointers provided from a guest system's QXL graphics card driver. A privileged guest user could use this flaw to cause the host to dereference an invalid pointer,...

Information Disclosure

kvm is vulnerable to information disclosure. The vulnerability exists as a data structure field in kvmvcpuioctlx86getvcpuevents in QEMU-KVM was not initialized properly before being copied to user-space. A privileged host user with access to "/dev/kvm" could use this flaw to leak kernel stack...

Information Disclosure

kvm is vulnerable to information disclosure. The vulnerability exists as it was found that some structure padding and reserved fields in certain data structures in QEMU-KVM were not initialized properly before being copied to user-space. A privileged host user with access to "/dev/kvm" could use...

Denial Of Service (DoS)

kernel is vulnerable to denial of service DoS. The vulnerability exists as a flaw was found in the way KVM Kernel-based Virtual Machine handled the reloading of fs and gs segment registers when they had invalid selectors. A privileged host user with access to "/dev/kvm" could use this flaw to cra...

Denial Of Service (DoS)

The Simple Protocol for Independent Computing Environments SPICE is vulnerable to Denial Of Service DoS. It was found that the libspice component of QEMU-KVM on the host did not validate all pointers provided from a guest system's QXL graphics card driver. A privileged guest user could use this...

Denial Of Service (DoS)

The Simple Protocol for Independent Computing Environments SPICE is vulnerable to Denial Of Service DoS. It was found that the libspice component of QEMU-KVM on the host could be forced to perform certain memory management operations on memory addresses controlled by a guest. A privileged guest...

Denial Of Service (DoS)

kvm is vulnerable to denial of service. A flaw was found in the way QEMU-KVM handled erroneous data provided by the Linux virtio-net driver, used by guest operating systems. Due to a deficiency in the TSO TCP segment offloading implementation, a guest's virtio-net driver would transmit improper...

Arbitrary Code Execution

kvm is vulnerable to arbirary code execution. Gust OS users are able to read and write arbitrary QEMU memory by modifying the address used by Cairo for memory mappings...

qemu-kvm security update

1.5.3-173.el78.1 - kvm-util-add-slirpfmt-helpers.patch bz1798970 - kvm-tcpemu-fix-unsafe-snprintf-usages.patch bz1798970 - Resolves: bz1798970 CVE-2020-8608 qemu-kvm: QEMU: Slirp: potential OOB access due to unsafe snprintf usages rhel-7.8.z...

Oracle Linux 6 : qemu-kvm (ELSA-2020-1403)

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-1403 advisory. 0.12.1.2-2.506.el610.7 - kvm-slirp-disable-tcpemu.patch bz1791680 - kvm-slirp-add-slirpfmt-helpers.patch bz1798966 - kvm-tcpemu-fix-unsafe-snprintf-usages.patch...

Scientific Linux Security Update : qemu-kvm on SL6.x i386/x86_64 (20200408)

Security Fixes : - QEMU: Slirp: potential OOB access due to unsafe snprintf usages Bug Fixes : - QEMU: Slirp: disable emulation of tcp programs like ftp IRC etc. rhel-6 C Tenable Network Security, Inc. The descriptive text is C Scientific Linux. include"compat.inc"; if description scriptid135382;...

CVE-2020-8834

KVM in the Linux kernel on Power8 processors has a conflicting use of HSTATEHOSTR1 to store r1 state in kvmppchventry plus in kvmppcsave,restoretm, leading to a stack corruption. Because of this, an attacker with the ability run code in kernel space of a guest VM can cause the host kernel to pani...

CVE-2020-8834

KVM in the Linux kernel on Power8 processors has a conflicting use of HSTATEHOSTR1 to store r1 state in kvmppchventry plus in kvmppcsave,restoretm, leading to a stack corruption. Because of this, an attacker with the ability run code in kernel space of a guest VM can cause the host kernel to pani...

Design/Logic Flaw

KVM in the Linux kernel on Power8 processors has a conflicting use of HSTATEHOSTR1 to store r1 state in kvmppchventry plus in kvmppcsave,restoretm, leading to a stack corruption. Because of this, an attacker with the ability run code in kernel space of a guest VM can cause the host kernel to pani...