Vulnerability in qemu-kvm - security update
Summary
DLA-1350-1: qemu-kvm - security update. Affects qemu-kvm versions < 1.1.2+dfsg-6+deb7u25. Fixed in 1.1.2+dfsg-6+deb7u25. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
qemu-kvm is a package that provides a full virtualization solution for Linux on x86 hardware. It allows users to run virtual machines on their systems, providing them with the ability to emulate various hardware components. This package is widely used in server environments and is an integral part of many virtualization platforms. However, a security vulnerability has been discovered in qemu-kvm that could allow local guest OS users to execute arbitrary code on the host system.
Vulnerability Detail
The vulnerability, identified as CVE-2018-7550, resides in the load_multiboot function within the multiboot.c file of qemu-kvm. It arises due to improper handling of the mh_load_end_addr value, which can be manipulated by a local guest OS user. By providing a mh_load_end_addr value greater than mh_bss_end_addr, an out-of-bounds read or write memory access can be triggered. This can lead to the execution of arbitrary code on the host system, potentially compromising its security and integrity.
How To Fix
Minimum fixed version
1.1.2+dfsg-6+deb7u25
This is the first release that contains the fix.
sudo apt-get install --only-upgrade qemu-kvmTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No specific workaround has been provided for this vulnerability. It is essential to apply the recommended fix by upgrading the qemu-kvm package to the patched version.
Conclusion
In conclusion, the qemu-kvm package is vulnerable to a security issue that could allow local guest OS users to execute arbitrary code on the host system. To mitigate this vulnerability, it is crucial to upgrade the package to version 1.1.2+dfsg-6+deb7u25 or later. No specific workaround has been provided, and it is recommended to follow the official Debian LTS security advisories for further information and guidance on vulnerability remediation.
See every vulnerability recorded for qemu-kvm →
FAQ
qemu-kvm is a virtualization package that allows users to run virtual machines on their systems, emulating various hardware components.
The vulnerability in qemu-kvm could allow local guest OS users to execute arbitrary code on the host system, potentially compromising its security and integrity.
To fix this vulnerability, it is recommended to upgrade the qemu-kvm package to version 1.1.2+dfsg-6+deb7u25 or later.
No specific workaround has been provided for this vulnerability. It is crucial to apply the recommended fix by upgrading the qemu-kvm package.
You can find further information about Debian LTS security advisories, including how to apply updates and frequently asked questions, at https://wiki.debian.org/LTS.
Related vulnerabilities
Recent vulnerabilities recorded for qemu-kvm.
