QEMU 0.9.0 does not properly handle changes to removable media, which allows guest OS users to read arbitrary files on the host OS by using the diskformat: parameter in the -usbdevice option to modify the disk-image header to identify a different format, a related issue to CVE-2008-2004.
CVSS Details
- CVSS 3.1 Base Score: 7.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade xenUpgrade xen-develUpgrade xen-libs | Dec 1, 2016 | Aug 8, 2008 |
| Debian | — | Upgrade qemu | Jul 30, 2024 | Aug 8, 2008 |
| Oracle_linux | — | Upgrade xenUpgrade xen-develUpgrade xen-libs | Oct 16, 2024 | Aug 8, 2008 |
| Suse | — | Upgrade qemu-docUpgrade qemu-x86Upgrade qemu-audio-jackUpgrade qemu-guest-agentUpgrade qemu-audio-dbusUpgrade qemu-block-rbdUpgrade qemuUpgrade qemu-kvmUpgrade qemu-hw-usb-hostUpgrade qemu-ivshmem-toolsUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-microvmUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-block-nfsUpgrade qemu-SLOFUpgrade qemu-headlessUpgrade qemu-vmsr-helperUpgrade qemu-s390xUpgrade qemu-sgabiosUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-toolsUpgrade qemu-ppcUpgrade qemu-vgabiosUpgrade qemu-langUpgrade qemu-ksmUpgrade qemu-hw-usb-smartcardUpgrade qemu-pr-helperUpgrade qemu-vhost-user-gpuUpgrade qemu-seabiosUpgrade qemu-s390Upgrade qemu-linux-userUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-block-iscsiUpgrade qemu-block-dmgUpgrade qemu-hw-usb-redirectUpgrade qemu-armUpgrade qemu-audio-ossUpgrade qemu-imgUpgrade qemu-block-sshUpgrade qemu-block-curlUpgrade qemu-extraUpgrade qemu-audio-alsaUpgrade qemu-ipxeUpgrade qemu-skiboot | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade kvm | Nov 8, 2024 | Aug 8, 2008 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub