An user able to alter the savevm data (either on the disk or over the wire during migration) could use this flaw to to corrupt QEMU process memory on the (destination) host, which could potentially result in arbitrary code execution on the host with the privileges of the QEMU process.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade qemu-guest-agentUpgrade qemu-kvmUpgrade qemu-imgUpgrade libcacard-toolsUpgrade libcacardUpgrade libcacard-develUpgrade qemu-kvm-toolsUpgrade qemu-kvm-common | Aug 17, 2018 | Jul 25, 2014 |
| Debian | — | Upgrade qemu | Jul 30, 2024 | May 28, 2021 |
| Oracle_linux | — | Upgrade qemu-guest-agentUpgrade qemu-kvmUpgrade libcacard-develUpgrade qemu-imgUpgrade libcacard-toolsUpgrade qemu-kvm-commonUpgrade libcacardUpgrade qemu-kvm-tools | Oct 16, 2024 | May 28, 2021 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 28, 2021 |
| Suse | — | Upgrade kvm | Jun 26, 2014 | Jun 26, 2014 |
| Ubuntu | — | Upgrade qemu-systemUpgrade qemu-system-armUpgrade qemu-system-x86Upgrade qemu-system-sparcUpgrade qemu-system-aarch64Upgrade qemu-kvmUpgrade qemu-system-mipsUpgrade qemu-system-miscUpgrade qemu-system-ppc | Nov 8, 2024 | May 28, 2021 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub