Security Update for qemu-kvm
Summary
DSA-3285-1: qemu-kvm - security update. Affects qemu-kvm versions < 1.1.2+dfsg-6+deb7u8. Fixed in 1.1.2+dfsg-6+deb7u8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
qemu-kvm is a full virtualization solution on x86 hardware. It allows users to run virtual machines on their systems, providing a platform for testing, development, and deployment. This package is commonly used in various Linux distributions, including Debian 7 (wheezy).
Vulnerability Detail
A flaw was discovered in qemu-kvm's AMD PCnet Ethernet emulation. This vulnerability, identified as CVE-2015-3209, allows a privileged guest user in a virtual machine with an AMD PCNet ethernet card enabled to execute arbitrary code on the host system with the privileges of the hosting QEMU process. The flaw occurs when handling multi-TMD packets with a length above 4096 bytes.
How To Fix
Minimum fixed version
1.1.2+dfsg-6+deb7u8
This is the first release that contains the fix.
sudo apt-get install --only-upgrade qemu-kvmTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
qemu-kvm users are strongly recommended to upgrade their packages to version 1.1.2+dfsg-6+deb7u8 or later to mitigate the security vulnerabilities. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for qemu-kvm →
FAQ
qemu-kvm is a full virtualization solution on x86 hardware that allows users to run virtual machines on their systems.
The vulnerability (CVE-2015-3209) allows a privileged guest user to execute arbitrary code on the host system with the privileges of the hosting QEMU process.
The vulnerability affects qemu-kvm version 1.1.2+dfsg-6+deb7u7 and earlier.
You can check the version of qemu-kvm by running the command 'qemu-kvm --version' in the terminal.
Yes, the vulnerability has been fixed in qemu-kvm version 1.1.2+dfsg-6+deb7u8. Users are advised to upgrade to this version or later.
Related vulnerabilities
Recent vulnerabilities recorded for qemu-kvm.
