Your submission was sent successfully! Close

CVE-2013-2016

Published: 30 December 2019

A flaw was found in the way qemu v1.3.0 and later (virtio-rng) validates addresses when guest accesses the config space of a virtio device. If the virtio device has zero/small sized config space, such as virtio-rng, a privileged guest user could use this flaw to access the matching host's qemu address space and thus increase their privileges on the host.

Notes

AuthorNote
mdeslaur
introduced in 1.3.0+
low because of mmap_min_addr
Priority

Low

CVSS 3 base score: 7.8

Status

Package Release Status
kvm
Launchpad, Ubuntu, Debian
hardy Ignored
(reached end-of-life)
lucid Does not exist

oneiric Does not exist

precise Does not exist

quantal Does not exist

raring Does not exist

saucy Does not exist

upstream Needed

qemu
Launchpad, Ubuntu, Debian
hardy Ignored
(reached end-of-life)
lucid Does not exist

oneiric Does not exist

precise Does not exist

quantal Does not exist

raring Ignored
(reached end-of-life)
saucy Not vulnerable
(1.5.0+dfsg-3ubuntu5)
upstream
Released (1.5.0)
qemu-kvm
Launchpad, Ubuntu, Debian
hardy Does not exist

lucid Not vulnerable
(0.12.3+noroms-0ubuntu9.21)
oneiric Not vulnerable
(0.14.1+noroms-0ubuntu6.6)
precise Not vulnerable
(1.0+noroms-0ubuntu14.8)
quantal Not vulnerable
(1.2.0+noroms-0ubuntu2.12.10.3)
raring Does not exist

saucy Does not exist

upstream Needed

Patches:
proposed: https://lists.gnu.org/archive/html/qemu-devel/2013-04/msg05254.html
upstream: http://git.qemu.org/?p=qemu.git;a=commit;h=5f5a1318653c08e435cfa52f60b6a712815b659d
xen-3.1
Launchpad, Ubuntu, Debian
hardy Ignored
(reached end-of-life)
lucid Does not exist

oneiric Does not exist

precise Does not exist

quantal Does not exist

raring Does not exist

saucy Does not exist

upstream Not vulnerable

xen-3.2
Launchpad, Ubuntu, Debian
hardy Ignored
(reached end-of-life)
lucid Does not exist

oneiric Does not exist

precise Does not exist

quantal Does not exist

raring Does not exist

saucy Does not exist

upstream Not vulnerable

xen-3.3
Launchpad, Ubuntu, Debian
hardy Does not exist

lucid Not vulnerable

oneiric Does not exist

precise Does not exist

quantal Does not exist

raring Does not exist

saucy Does not exist

upstream Not vulnerable