CVE-2012-3515

2012-09-0600:00:00

ubuntu.com

7.2 High

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:L/AC:L/Au:N/C:C/I:C/A:C

0.001 Low

EPSS

Percentile

28.7%

JSON

Qemu, as used in Xen 4.0, 4.1 and possibly other products, when emulating
certain devices with a virtual console backend, allows local OS guest users
to gain privileges via a crafted escape VT100 sequence that triggers the
overwrite of a “device model’s address space.”

Bugs

Notes

Author	Note
kees	for full-virtualization issues, add qemu (and kvm)
mdeslaur	This is XSA-17 Also affects qemu-kvm
jdstrand	xen-qemu-dm-4.0 needs libxen-dev >= 4.0, but it isn’t available in 11.04, as a result, there are no binaries available in 11.04.

OSVersionArchitecturePackageVersionFilename
ubuntu10.04noarchqemu-kvm< 0.12.3+noroms-0ubuntu9.20UNKNOWN
ubuntu11.04noarchqemu-kvm< 0.14.0+noroms-0ubuntu4.7UNKNOWN
ubuntu11.10noarchqemu-kvm< 0.14.1+noroms-0ubuntu6.5UNKNOWN
ubuntu12.04noarchqemu-kvm< 1.0+noroms-0ubuntu14.2UNKNOWN
ubuntu11.10noarchxen< 4.1.1-2ubuntu4.4UNKNOWN
ubuntu12.04noarchxen< 4.1.2-2ubuntu2.4UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	10.04	noarch	qemu-kvm	< 0.12.3+noroms-0ubuntu9.20	UNKNOWN
ubuntu	11.04	noarch	qemu-kvm	< 0.14.0+noroms-0ubuntu4.7	UNKNOWN
ubuntu	11.10	noarch	qemu-kvm	< 0.14.1+noroms-0ubuntu6.5	UNKNOWN
ubuntu	12.04	noarch	qemu-kvm	< 1.0+noroms-0ubuntu14.2	UNKNOWN
ubuntu	11.10	noarch	xen	< 4.1.1-2ubuntu4.4	UNKNOWN
ubuntu	12.04	noarch	xen	< 4.1.2-2ubuntu2.4	UNKNOWN