5.8

CVE-2011-2512

The virtio_queue_notify in qemu-kvm 0.14.0 and earlier does not properly validate the virtqueue number, which allows guest users to cause a denial of service (guest crash) and possibly execute arbitrary code via a negative number in the Queue Notify field of the Virtio Header, which bypasses a signed comparison.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Kvm Group ≫ Qemu-kvm Version <= 0.14.0
Kvm Group ≫ Qemu-kvm Version0.12
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.9% 0.77
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.8 6.5 6.4
AV:A/AC:L/Au:N/C:P/I:P/A:P
CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

http://secunia.com/advisories/44458
Vendor Advisory
http://secunia.com/advisories/44648
Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2011-07/msg00007.html
http://rhn.redhat.com/errata/RHSA-2011-0919.html
http://secunia.com/advisories/45158
Vendor Advisory
http://secunia.com/advisories/45170
Vendor Advisory
http://secunia.com/advisories/45301
Vendor Advisory
http://ubuntu.com/usn/usn-1165-1
http://www.osvdb.org/74751
https://hermes.opensuse.org/messages/9605323
http://git.kernel.org/?p=virt/kvm/qemu-kvm.git%3Ba=commitdiff%3Bh=7157e2e23e89adcd436caeab31fdd6b47eded377
http://www.openwall.com/lists/oss-security/2011/06/28/13
Patch
http://www.openwall.com/lists/oss-security/2011/06/29/15
Patch
https://www.debian.org/security/2011/dsa-2270