The virtio_queue_notify in qemu-kvm 0.14.0 and earlier does not properly validate the virtqueue number, which allows guest users to cause a denial of service (guest crash) and possibly execute arbitrary code via a negative number in the Queue Notify field of the Virtio Header, which bypasses a signed comparison.

A privileged guest user could cause a buffer overflow in the virtio subsystem of the host, therefore crashing the guest or potentially execute arbitrary code on the host (CVE-2011-2212, CVE-2011-2512).

From Red Hat Security Advisory 2011:0919 :

Updated qemu-kvm packages that fix two security issues and one bug are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on AMD64 and Intel 64 systems. qemu-kvm is the user-space component for running virtual machines using KVM.

It was found that the virtio subsystem in qemu-kvm did not properly validate virtqueue in and out requests from the guest. A privileged guest user could use this flaw to trigger a buffer overflow, allowing them to crash the guest (denial of service) or, possibly, escalate their privileges on the host. (CVE-2011-2212)

It was found that the virtio_queue_notify() function in qemu-kvm did not perform sufficient input validation on the value later used as an index into the array of virtqueues. An unprivileged guest user could use this flaw to crash the guest (denial of service) or, possibly, escalate their privileges on the host. (CVE-2011-2512)

Red Hat would like to thank Nelson Elhage for reporting CVE-2011-2212.

This update also fixes the following bug :

* A bug was found in the way vhost (in qemu-kvm) set up mappings with the host kernel's vhost module. This could result in the host kernel's vhost module not having a complete view of a guest system's memory, if that guest had more than 4 GB of memory. Consequently, hot plugging a vhost-net network device and restarting the guest may have resulted in that device no longer working. (BZ#701771)

All users of qemu-kvm should upgrade to these updated packages, which contain backported patches to resolve these issues. After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.

Updated qemu-kvm packages that fix two security issues and one bug are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on AMD64 and Intel 64 systems. qemu-kvm is the user-space component for running virtual machines using KVM.

It was found that the virtio subsystem in qemu-kvm did not properly validate virtqueue in and out requests from the guest. A privileged guest user could use this flaw to trigger a buffer overflow, allowing them to crash the guest (denial of service) or, possibly, escalate their privileges on the host. (CVE-2011-2212)

It was found that the virtio_queue_notify() function in qemu-kvm did not perform sufficient input validation on the value later used as an index into the array of virtqueues. An unprivileged guest user could use this flaw to crash the guest (denial of service) or, possibly, escalate their privileges on the host. (CVE-2011-2512)

Red Hat would like to thank Nelson Elhage for reporting CVE-2011-2212.

This update also fixes the following bug :

* A bug was found in the way vhost (in qemu-kvm) set up mappings with the host kernel's vhost module. This could result in the host kernel's vhost module not having a complete view of a guest system's memory, if that guest had more than 4 GB of memory. Consequently, hot plugging a vhost-net network device and restarting the guest may have resulted in that device no longer working. (BZ#701771)

All users of qemu-kvm should upgrade to these updated packages, which contain backported patches to resolve these issues. After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.

The remote host is affected by the vulnerability described in GLSA-201210-04 (qemu-kvm: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in qemu-kvm. Please review       the CVE identifiers referenced below for details.
  Impact :

    These vulnerabilities allow a remote attacker to cause a Denial of       Service condition on the host server or qemu process, might allow for       arbitrary code execution or a symlink attack when qemu-kvm is in snapshot       mode.
  Workaround :

    There is no known workaround at this time.

A privileged guest user could cause a buffer overflow in the virtio subsystem of the host, therefore crashing the guest or potentially execute arbitrary code on the host. (CVE-2011-2212 / CVE-2011-2512)

Nelson Elhage discoverd that QEMU did not properly validate certain virtqueue requests from the guest. An attacker could exploit this to cause a denial of service of the guest or possibly execute code with the privileges of the user invoking the program. (CVE-2011-2212)

Stefan Hajnoczi discovered that QEMU did not properly perform integer comparisons when performing virtqueue input validation. An attacker could exploit this to cause a denial of service of the guest or possibly execute code with the privileges of the user invoking the program. (CVE-2011-2512)

When using QEMU with libvirt or virtualization management software based on libvirt such as Eucalyptus and OpenStack, QEMU guests are individually isolated by an AppArmor profile by default in Ubuntu.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that incorrect sanitising of virtio queue commands in KVM, a solution for full virtualization on x86 hardware, could lead to denial of service or the execution of arbitrary code.

The oldstable distribution (lenny) is not affected by this problem.

ID	Name	Product	Family	Severity
75888	openSUSE Security Update : kvm (openSUSE-SU-2011:0803-1)	Nessus	SuSE Local Security Checks	high
75567	openSUSE Security Update : kvm (openSUSE-SU-2011:0803-1)	Nessus	SuSE Local Security Checks	high
68301	Oracle Linux 6 : qemu-kvm (ELSA-2011-0919)	Nessus	Oracle Linux Local Security Checks	high
63987	RHEL 6 : qemu-kvm (RHSA-2011:0919)	Nessus	Red Hat Local Security Checks	high
62634	GLSA-201210-04 : qemu-kvm: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
55620	SuSE 11.1 Security Update : KVM (SAT Patch Number 4814)	Nessus	SuSE Local Security Checks	high
55531	Ubuntu 10.04 LTS / 10.10 / 11.04 : qemu-kvm vulnerabilities (USN-1165-1)	Nessus	Ubuntu Local Security Checks	high
55490	Debian DSA-2270-1 : qemu-kvm - programming error	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2011-2512

high

Tenable Plugins

high

high

high

high

high

high

high

medium