Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 523
Alerts This Week
Warning Icon 1 523

Debian: DLA-965-1 Urgent: QEMU-KVM Access Vulnerability Alert

debian lts
Calendar Grey May 31, 2017
Scroller Debian Lts
Urgent patch release for qemu-kvm targeting numerous vulnerabilities leading to privilege escalation and memory exposure in Debian.
Several vulnerabilities were discovered in qemu-kvm, a full virtualization solution for Linux hosts on x86 hardware with x86 guests based on the Quick Emulator(Qemu)
Topics%20covered

Topics Covered

security advisory critical debian access issue memory leak

Summary

Quick Emulator(Qemu) built with the VirtFS, host directory sharing via
Plan 9 File System(9pfs) support, is vulnerable to an improper link
following issue. It could occur while accessing symbolic link files
on a shared host directory.

A privileged user inside guest could use this flaw to access host file
system beyond the shared folder and potentially escalating their
privileges on a host.

CVE-2017-7377

Quick Emulator(Qemu) built with the virtio-9p back-end support is
vulnerable to a memory leakage issue. It could occur while doing a I/O
operation via v9fs_create/v9fs_lcreate routine.

A privileged user/process inside guest could use this flaw to leak
host memory resulting in Dos.

CVE-2017-7471

Quick Emulator(Qemu) built with the VirtFS, host directory sharing via
Plan 9 File System(9pfs) support, is vulnerable to an improper access
control issue. It could occur while accessing files on a shared host
directory.

Read the Full Advisory


Severity
critical
Lowest
Low
Medium
High
Critical

<pre><font face="Courier">Package: qemu-kvm
Version: 1.1.2+dfsg-6+deb7u22
CVE ID: CVE-2016-9602 CVE-2017-7377 CVE-2017-7471 CVE-2017-7493

Topics%20covered

Topics Covered

security advisory critical debian access issue memory leak

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.