An user able to alter the savevm data (either on the disk or over the wire during migration) could use this flaw to to corrupt QEMU process memory on the (destination) host, which could potentially result in arbitrary code execution on the host with the privileges of the QEMU process.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade qemu-imgUpgrade qemu-guest-agentUpgrade qemu-kvmUpgrade qemu-kvm-toolsUpgrade qemu-kvm-commonUpgrade libcacard-develUpgrade libcacard-toolsUpgrade libcacard | Aug 17, 2018 | Jul 25, 2014 |
| Debian | — | Upgrade qemu | Jul 30, 2024 | May 28, 2021 |
| Oracle_linux | — | Upgrade libcacard-toolsUpgrade libcacardUpgrade libcacard-develUpgrade qemu-kvm-commonUpgrade qemu-imgUpgrade qemu-kvm-toolsUpgrade qemu-guest-agentUpgrade qemu-kvm | Oct 16, 2024 | May 28, 2021 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 28, 2021 |
| Suse | — | Upgrade kvm | Jun 26, 2014 | Jun 26, 2014 |
| Ubuntu | — | Upgrade qemu-system-mipsUpgrade qemu-system-ppcUpgrade qemu-system-aarch64Upgrade qemu-system-miscUpgrade qemu-kvmUpgrade qemu-system-x86Upgrade qemu-system-armUpgrade qemu-system-sparcUpgrade qemu-system | Nov 8, 2024 | May 28, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub