(0Day) Parallels Desktop virtio-net Memory Corruption Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the...

CVE-2021-3748

A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the descriptor's address belongs to the non direct access region, due to numbuffers being set after the virtqueue elem has been unmapped. A malicious guest could use this flaw to crash QEMU, resulting i...

UBUNTU-CVE-2021-3748

A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the descriptor's address belongs to the non direct access region, due to numbuffers being set after the virtqueue elem has been unmapped. A malicious guest could use this flaw to crash QEMU, resulting i...

CVE-2021-3748

A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the descriptor's address belongs to the non direct access region, due to numbuffers being set after the virtqueue elem has been unmapped. A malicious guest could use this flaw to crash QEMU, resulting i...

PT-2021-6089

Name of the Vulnerable Software and Affected Versions QEMU affected versions not specified Description A use-after-free issue was found in the virtio-net device of QEMU. This could occur when the descriptor's address belongs to the non direct access region, due to num buffers being set after the...

GSD-2021-1001227 virtio-net: Add validation for used length

virtio-net: Add validation for used length This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.13.3 by commit...

PT-2021-25769

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to 5.10.51 Description The issue concerns the virtio-net component, where validation for used length is added. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel...

PT-2021-29692

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to 5.13.3 Description The issue concerns the virtio-net component, where validation for used length is added. This change is intended to aid in the discovery of potential security vulnerabilities. The actual impact...

PT-2021-29764

Name of the Vulnerable Software and Affected Versions Linux Kernel versions prior to 5.10.51 Description The issue concerns the virtio-net component, where validation for used length is added. The actual impact and attack plausibility have not yet been proven. Recommendations For Linux Kernel...

PT-2021-25697

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to 5.13.3 Description: The issue concerns the virtio-net component, where validation for used length is added. This change is intended to aid in the discovery of potential security vulnerabilities. The actual impac...

PT-2021-28239

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-use-after-free error, which occurs when the program attempts to access memory that has already been freed. The crash state...

qemu:qemu-fuzz-i386-target-generic-fuzz-virtio-net-pci-slirp: Heap-use-after-free in iov_from_buf_full

Detailed Report: https://oss-fuzz.com/testcase?key=5164103938211840 Project: qemu Fuzzing Engine: libFuzzer Fuzz Target: qemu-fuzz-i386-target-generic-fuzz-virtio-net-pci-slirp Job Type: libfuzzerasanqemu Platform Id: linux Crash Type: Heap-use-after-free WRITE 2 Crash Address: 0x62500011e00a Cra...

qemu:qemu-fuzz-i386-target-generic-fuzz-virtio-net-pci-slirp: Heap-use-after-free in iov_from_buf_full

Detailed Report: https://oss-fuzz.com/testcase?key=6249372784394240 Project: qemu Fuzzing Engine: libFuzzer Fuzz Target: qemu-fuzz-i386-target-generic-fuzz-virtio-net-pci-slirp Job Type: libfuzzerasanqemu Platform Id: linux Crash Type: Heap-use-after-free WRITE 2 Crash Address: 0x6250001f700a Cra...

Low: Red Hat Security Advisory: qemu-kvm-rhev security, bug fix, and enhancement update

An update for qemu-kvm-rhev is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 7 and Red Hat Virtualization Engine 4.3. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a...

Oracle VirtualBox virtio-net Uninitialized Memory Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose sensitive information on affected installations of Oracle VirtualBox. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within...

Oracle VirtualBox virtio-net Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose sensitive information on affected installations of Oracle VirtualBox. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within...

Medium: kernel

Issue Overview: A stack buffer overflow issue was found in the getrawsocket routine of the Host kernel accelerator for virtio net vhost-net driver. It could occur while doing an ictolVHOSTNETSETBACKEND call, and retrieving socket name in a kernel stack variable via getrawsocket. A user able to...

Denial Of Service (DoS)

kvm is vulnerable to denial of service. A flaw was found in the way QEMU-KVM handled erroneous data provided by the Linux virtio-net driver, used by guest operating systems. Due to a deficiency in the TSO TCP segment offloading implementation, a guest's virtio-net driver would transmit improper...

CVE-2020-10942

A stack buffer overflow issue was found in the getrawsocket routine of the Host kernel accelerator for virtio net vhost-net driver. It could occur while doing an ictolVHOSTNETSETBACKEND call, and retrieving socket name in a kernel stack variable via getrawsocket. A user able to perform ioctl2 cal...

Ubuntu 16.04 LTS : Linux kernel vulnerabilities (USN-4116-1)

The remote Ubuntu 16.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4116-1 advisory. It was discovered that a use-after-free error existed in the block layer subsystem of the Linux kernel when certain failure conditions occurred. A local...