Privilege Escalation

2019-01-1508:56:42

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.0004 Low

EPSS

Percentile

5.1%

JSON

QEMU-kvm is vulnerable to privilege escalation. An unquoted search path flaw was found in the way the QEMU Guest Agent service installation was performed on Windows. Depending on the permissions of the directories in the unquoted search path, a local unprivileged user could use this flaw to have a binary of their choosing executed with SYSTEM privileges.

CPENameOperatorVersion
qemu-kvmeq0.12.1.2__2.160.el6_1.3
qemu-kvmeq0.12.1.2__2.160.el6_1.9
qemu-kvmeq0.12.1.2__2.113.el6_0.6
qemu-kvmeq0.12.1.2__2.113.el6
qemu-kvmeq0.12.1.2__2.295.el6
qemu-kvmeq0.12.1.2__2.160.el6_1.6
qemu-kvmeq0.12.1.2__2.209.el6_2.4
qemu-kvmeq0.12.1.2__2.160.el6_1.2
qemu-kvmeq0.12.1.2__2.295.el6_3.8
qemu-kvmeq0.12.1.2__2.113.el6_0.3

Name	Operator	Version
qemu-kvm	eq	0.12.1.2__2.160.el6_1.3
qemu-kvm	eq	0.12.1.2__2.160.el6_1.9
qemu-kvm	eq	0.12.1.2__2.113.el6_0.6
qemu-kvm	eq	0.12.1.2__2.113.el6
qemu-kvm	eq	0.12.1.2__2.295.el6
qemu-kvm	eq	0.12.1.2__2.160.el6_1.6
qemu-kvm	eq	0.12.1.2__2.209.el6_2.4
qemu-kvm	eq	0.12.1.2__2.160.el6_1.2
qemu-kvm	eq	0.12.1.2__2.295.el6_3.8
qemu-kvm	eq	0.12.1.2__2.113.el6_0.3