Quick Emulator (Qemu) built with the VirtFS, host directory sharing via Plan 9 File System(9pfs) support, is vulnerable to an improper access control issue. It could occur while accessing virtfs metadata files in mapped-file security mode. A guest user could use this flaw to escalate their privileges inside guest.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemuUpgrade qemu-kvm | May 30, 2017 | May 17, 2017 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Oct 30, 2017 | May 17, 2017 |
| Oracle_linux | — | Upgrade qemu-kvmUpgrade qemu-block-rbdUpgrade qemu-commonUpgrade qemu-kvm-coreUpgrade qemu-system-x86-coreUpgrade qemuUpgrade qemu-block-glusterUpgrade qemu-system-x86Upgrade qemu-block-iscsiUpgrade qemu-system-aarch64-coreUpgrade qemu-system-aarch64Upgrade ivshmem-toolsUpgrade qemu-img | May 15, 2019 | May 16, 2017 |
| Suse | — | Upgrade qemu-chardev-baumUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-audio-spiceUpgrade qemu-ui-spice-coreUpgrade qemu-audio-alsaUpgrade qemu-block-iscsiUpgrade qemu-ksmUpgrade qemu-ui-spice-appUpgrade qemu-langUpgrade qemu-ipxeUpgrade qemu-guest-agentUpgrade qemu-s390xUpgrade qemu-ppcUpgrade qemu-block-rbdUpgrade qemu-armUpgrade qemu-chardev-spiceUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-toolsUpgrade qemu-skibootUpgrade qemu-seabiosUpgrade qemu-ui-openglUpgrade qemu-s390Upgrade qemu-block-sshUpgrade qemu-block-curlUpgrade qemu-audio-ossUpgrade qemu-ui-cursesUpgrade qemuUpgrade qemu-vgabiosUpgrade qemu-kvmUpgrade qemu-ui-gtkUpgrade qemu-microvmUpgrade qemu-sgabiosUpgrade qemu-hw-usb-redirectUpgrade qemu-hw-display-qxlUpgrade qemu-audio-paUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-x86Upgrade kvmUpgrade qemu-hw-display-virtio-vga | Jul 4, 2017 | May 17, 2017 |
| Ubuntu | — | Upgrade qemu-system-x86Upgrade qemu-systemUpgrade qemu-system-mipsUpgrade qemu-system-ppcUpgrade qemu-system-sparcUpgrade qemu-system-armUpgrade qemu-system-s390xUpgrade qemu-system-miscUpgrade qemu-system-aarch64 | Sep 13, 2017 | May 17, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub