QEMU vulnerabilities

Releases

• Ubuntu 11.04
• Ubuntu 10.10
• Ubuntu 10.04

Packages

• qemu-kvm - Machine emulator and virtualizer

Details

It was discovered that QEMU did not properly perform validation of I/O
operations from the guest which could lead to heap corruption. An attacker
could exploit this to cause a denial of service of the guest or possibly
execute code with the privileges of the user invoking the program.
(CVE-2011-1750)

Nelson Elhage discoverd that QEMU did not properly handle memory when
removing ISA devices. An attacker could exploit this to cause a denial of
service of the guest or possibly execute code with the privileges of the
user invoking the program. (CVE-2011-1751)

When using QEMU with libvirt or virtualization management software based on
libvirt such as Eucalyptus and OpenStack, QEMU guests are individually isolated
by an AppArmor profile by default in Ubuntu.