Security Update for qemu-kvm
Summary
DSA-3349-1: qemu-kvm - security update. Affects qemu-kvm versions < 1.1.2+dfsg-6+deb7u9. Fixed in 1.1.2+dfsg-6+deb7u9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
qemu-kvm is a full virtualization solution on x86 hardware. It allows users to run multiple virtual machines on a single physical machine, providing isolation and flexibility. However, several vulnerabilities have been discovered in qemu-kvm that could potentially be exploited by malicious guests.
Vulnerability Detail
One of the vulnerabilities, identified as CVE-2015-5165, affects the QEMU model of the RTL8139 network card. This vulnerability arises from insufficient input validation in the C+ mode offload emulation. As a result, a malicious guest could exploit this flaw to read uninitialized memory from the QEMU process's heap.
Another vulnerability, known as CVE-2015-5745, involves a buffer overflow in the handling of the virtio-serial device. If exploited, a malicious guest could cause a denial of service by crashing the QEMU process.
How To Fix
Minimum fixed version
1.1.2+dfsg-6+deb7u9
This is the first release that contains the fix.
sudo apt-get install --only-upgrade qemu-kvmTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
qemu-kvm has been found to have two vulnerabilities, CVE-2015-5165 and CVE-2015-5745. These vulnerabilities can be fixed by upgrading to version 1.1.2+dfsg-6+deb7u9 or later. It is crucial to promptly apply the security update to mitigate the potential risks associated with these vulnerabilities. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for qemu-kvm →
FAQ
qemu-kvm is a full virtualization solution that allows users to run virtual machines on x86 hardware.
CVE-2015-5165 is a vulnerability in qemu-kvm that enables a malicious guest to read uninitialized memory from the QEMU process's heap.
CVE-2015-5745 is a vulnerability in qemu-kvm that can be exploited by a malicious guest to crash the QEMU process through a buffer overflow.
To fix these vulnerabilities, you should upgrade your qemu-kvm packages to version 1.1.2+dfsg-6+deb7u9 or later.
No specific workaround has been provided for these vulnerabilities. It is recommended to apply the security update.
Related vulnerabilities
Recent vulnerabilities recorded for qemu-kvm.
