QEMU 0.9.0 does not properly handle changes to removable media, which allows guest OS users to read arbitrary files on the host OS by using the diskformat: parameter in the -usbdevice option to modify the disk-image header to identify a different format, a related issue to CVE-2008-2004.
CVSS Details
- CVSS 3.1 Base Score: 7.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade xenUpgrade xen-libsUpgrade xen-devel | Dec 1, 2016 | Aug 8, 2008 |
| Debian | — | Upgrade qemu | Jul 30, 2024 | Aug 8, 2008 |
| Oracle_linux | — | Upgrade xenUpgrade xen-libsUpgrade xen-devel | Oct 16, 2024 | Aug 8, 2008 |
| Suse | — | Upgrade qemu-block-nfsUpgrade qemu-headlessUpgrade qemu-toolsUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-vgabiosUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-block-rbdUpgrade qemu-docUpgrade qemu-hw-usb-hostUpgrade qemu-ivshmem-toolsUpgrade qemu-x86Upgrade qemu-SLOFUpgrade qemu-audio-jackUpgrade qemu-vmsr-helperUpgrade qemuUpgrade qemu-audio-dbusUpgrade qemu-microvmUpgrade qemu-kvmUpgrade qemu-sgabiosUpgrade qemu-ppcUpgrade qemu-guest-agentUpgrade qemu-s390xUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-ksmUpgrade qemu-block-sshUpgrade qemu-imgUpgrade qemu-s390Upgrade qemu-audio-alsaUpgrade qemu-ipxeUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-armUpgrade qemu-skibootUpgrade qemu-block-dmgUpgrade qemu-seabiosUpgrade qemu-vhost-user-gpuUpgrade qemu-hw-usb-redirectUpgrade qemu-linux-userUpgrade qemu-hw-usb-smartcardUpgrade qemu-block-iscsiUpgrade qemu-block-curlUpgrade qemu-audio-ossUpgrade qemu-langUpgrade qemu-extraUpgrade qemu-pr-helper | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade kvm | Nov 8, 2024 | Aug 8, 2008 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub