Buffer overflow in the ccid_card_vscard_handle_message function in hw/ccid-card-passthru.c in QEMU before 0.15.2 and 1.x before 1.0-rc4 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted VSC_ATR message.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2011-1777 advisory.

    - CVE: CVE-2011-4111

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Updated qemu-kvm packages that fix one security issue are now available for Red Hat Enterprise Linux 6.1 Extended Update Support.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on AMD64 and Intel 64 systems. qemu-kvm is the user-space component for running virtual machines using KVM.

A flaw was found in the way qemu-kvm handled VSC_ATR messages when a guest was configured for a CCID (Chip/Smart Card Interface Devices) USB smart card reader in passthrough mode. An attacker able to connect to the port on the host being used for such a device could use this flaw to crash the qemu-kvm process on the host or, possibly, escalate their privileges on the host. (CVE-2011-4111)

All users of qemu-kvm should upgrade to these updated packages, which contain a backported patch to resolve this issue. After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2011:1777 advisory.

  - qemu: ccid: buffer overflow in handling of VSC_ATR message (CVE-2011-4111)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on AMD64 and Intel 64 systems. qemu-kvm is the user-space component for running virtual machines using KVM.

It was found that qemu-kvm did not properly drop supplemental group privileges when the root user started guests from the command line ('/usr/libexec/qemu-kvm') with the '-runas' option. A qemu-kvm process started this way could use this flaw to gain access to files on the host that are accessible to the supplementary groups and not accessible to the primary group. (CVE-2011-2527)

Note: This issue only affected qemu-kvm when it was started directly from the command line. It did not affect applications that start qemu-kvm via libvirt, such as the Virtual Machine Manager (virt-manager).

A flaw was found in the way qemu-kvm handled VSC_ATR messages when a guest was configured for a CCID (Chip/Smart Card Interface Devices) USB smart card reader in passthrough mode. An attacker able to connect to the port on the host being used for such a device could use this flaw to crash the qemu-kvm process on the host or, possibly, escalate their privileges on the host. (CVE-2011-4111)

All users of qemu-kvm should upgrade to these updated packages, which contain a backported patch to resolve this issue. After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.

A number of additional packages were added to the security repository so that this package could be installed on older SL systems.

Updated qemu-kvm packages that fix one security issue are now available for Red Hat Enterprise Linux 6.

The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on AMD64 and Intel 64 systems. qemu-kvm is the user-space component for running virtual machines using KVM.

A flaw was found in the way qemu-kvm handled VSC_ATR messages when a guest was configured for a CCID (Chip/Smart Card Interface Devices) USB smart card reader in passthrough mode. An attacker able to connect to the port on the host being used for such a device could use this flaw to crash the qemu-kvm process on the host or, possibly, escalate their privileges on the host. (CVE-2011-4111)

All users of qemu-kvm should upgrade to these updated packages, which contain a backported patch to resolve this issue. After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.

ID	Name	Product	Family	Severity
68398	Oracle Linux 6 : qemu-kvm (ELSA-2011-1777)	Nessus	Oracle Linux Local Security Checks	critical
64014	RHEL 6 : qemu-kvm (RHSA-2011:1801)	Nessus	Red Hat Local Security Checks	medium
64009	RHEL 6 : qemu-kvm (RHSA-2011:1777)	Nessus	Red Hat Local Security Checks	critical
61195	Scientific Linux Security Update : qemu-kvm on SL6.x x86_64	Nessus	Scientific Linux Local Security Checks	medium
57377	CentOS 6 : qemu-kvm (CESA-2011:1801)	Nessus	CentOS Local Security Checks	medium
57373	CentOS 6 : qemu-kvm (CESA-2011:1777)	Nessus	CentOS Local Security Checks	medium

Detections

Analytics

CVE-2011-4111

critical

Tenable Plugins

critical

medium

critical

medium

medium

medium