CVE-2009-3616
Published: 23 October 2009
Multiple use-after-free vulnerabilities in vnc.c in the VNC server in QEMU 0.10.6 and earlier might allow guest OS users to execute arbitrary code on the host OS by establishing a connection from a VNC client and then (1) disconnecting during data transfer, (2) sending a message using incorrect integer data types, or (3) using the Fuzzy Screen Mode protocol, related to double free vulnerabilities.
Notes
| Author | Note |
|---|---|
| jdstrand | versions 0.9.1 and earlier are not affected. Need the following commit to be affected: http://git.savannah.gnu.org/cgit/qemu.git/commit/?id=753b405331. This came in 0.10.0 (from ChangeLog: 'Multiple VNC clients are now supported') kvm-84 as included in Ubuntu 9.04 does not contain the affected code (it has a pre-release version of qemu 0.10.0) kvm-84 in hardy-backports and intrepid-backports are not affected (they are based on kvm-84 from Ubuntu 9.04) simply search for VncDisplay in vnc.c to see if might be affected |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
kvm Launchpad, Ubuntu, Debian |
dapper |
Does not exist
|
| hardy |
Not vulnerable
|
|
| intrepid |
Not vulnerable
|
|
| jaunty |
Not vulnerable
(code not present)
|
|
| karmic |
Does not exist
|
|
| lucid |
Does not exist
|
|
| maverick |
Does not exist
|
|
| upstream |
Needs triage
|
|
|
qemu Launchpad, Ubuntu, Debian |
dapper |
Not vulnerable
|
| hardy |
Not vulnerable
|
|
| intrepid |
Not vulnerable
(code not present)
|
|
| jaunty |
Ignored
(end of life)
|
|
| karmic |
Does not exist
|
|
| lucid |
Does not exist
|
|
| maverick |
Does not exist
|
|
| upstream |
Released
(0.10.7)
|
|
|
Patches: upstream: http://git.savannah.gnu.org/cgit/qemu.git/commit/?h=stable-0.10&id=c2723a9606 |
||
|
qemu-kvm Launchpad, Ubuntu, Debian |
dapper |
Does not exist
|
| hardy |
Does not exist
|
|
| intrepid |
Does not exist
|
|
| jaunty |
Does not exist
|
|
| karmic |
Not vulnerable
(0.11.0-0ubuntu1)
|
|
| lucid |
Not vulnerable
(0.11.0-0ubuntu1)
|
|
| maverick |
Not vulnerable
(0.11.0-0ubuntu1)
|
|
| upstream |
Released
(0.11.0)
|
|
|
Patches: vendor: http://git.savannah.gnu.org/cgit/qemu.git/commit/?id=198a0039c5 |
||
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 9.9 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | None |
| Scope | Changed |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |