Quick Emulator (Qemu) built with the VirtFS, host directory sharing via Plan 9 File System(9pfs) support, is vulnerable to an improper access control issue. It could occur while accessing virtfs metadata files in mapped-file security mode. A guest user could use this flaw to escalate their privileges inside guest.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemuUpgrade qemu-kvm | May 30, 2017 | May 17, 2017 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Oct 30, 2017 | May 17, 2017 |
| Oracle_linux | — | Upgrade qemu-block-glusterUpgrade qemu-block-iscsiUpgrade qemu-system-aarch64-coreUpgrade qemu-system-aarch64Upgrade qemu-system-x86Upgrade ivshmem-toolsUpgrade qemu-imgUpgrade qemu-kvm-coreUpgrade qemu-block-rbdUpgrade qemu-commonUpgrade qemu-system-x86-coreUpgrade qemu-kvmUpgrade qemu | May 15, 2019 | May 16, 2017 |
| Suse | — | Upgrade qemu-ui-spice-appUpgrade qemu-block-iscsiUpgrade qemu-audio-alsaUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-ksmUpgrade qemu-langUpgrade qemu-block-sshUpgrade qemu-s390Upgrade qemu-ppcUpgrade qemu-chardev-spiceUpgrade qemu-seabiosUpgrade qemu-guest-agentUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-block-rbdUpgrade qemu-toolsUpgrade qemu-armUpgrade qemu-skibootUpgrade qemu-chardev-baumUpgrade qemu-s390xUpgrade qemu-ipxeUpgrade qemu-ui-openglUpgrade qemu-audio-spiceUpgrade qemu-ui-spice-coreUpgrade qemu-hw-usb-redirectUpgrade qemu-audio-ossUpgrade qemu-block-curlUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-ui-cursesUpgrade qemuUpgrade qemu-microvmUpgrade qemu-vgabiosUpgrade qemu-x86Upgrade qemu-hw-display-qxlUpgrade qemu-sgabiosUpgrade qemu-audio-paUpgrade kvmUpgrade qemu-kvmUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-ui-gtk | Jul 4, 2017 | May 17, 2017 |
| Ubuntu | — | Upgrade qemu-system-sparcUpgrade qemu-system-ppcUpgrade qemu-system-mipsUpgrade qemu-system-x86Upgrade qemu-systemUpgrade qemu-system-armUpgrade qemu-system-aarch64Upgrade qemu-system-miscUpgrade qemu-system-s390x | Sep 13, 2017 | May 17, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub