The bdrv_open function in Qemu 1.0 does not properly handle the failure of the mkstemp function, when in snapshot node, which allows local users to overwrite or read arbitrary files via a symlink attack on an unspecified temporary file.

- fix vulnerability to temporary file symlink attacks in     snapshot file mode. (bnc#764526) (CVE-2012-2652)

Updated qemu packages fix security vulnerability :

A flaw was found in how qemu, in snapshot mode (-snapshot command line argument), handled the creation and opening of the temporary file used to store the difference of the virtualized guest's read-only image and the current state. In snapshot mode, bdrv_open() creates an empty temporary file without checking for any mkstemp() or close() failures;
it also ignores the possibility of a buffer overrun given an exceptionally long /tmp. Because qemu re-opens that file after creation, it is possible to race qemu and insert a symbolic link with the same expected name as the temporary file, pointing to an attacker-chosen file. This can be used to either overwrite the destination file with the privileges of the user running qemu (typically root), or to point to an attacker-readable file that could expose data from the guest to the attacker (CVE-2012-2652).

A flaw was found in the way QEMU handled VT100 terminal escape sequences when emulating certain character devices. A guest user with privileges to write to a character device that is emulated on the host using a virtual console back-end could use this flaw to crash the qemu-kvm process on the host or, possibly, escalate their privileges on the host (CVE-2012-3515).

It was discovered that the e1000 emulation code in QEMU does not enforce frame size limits in the same way as the real hardware does.
This could trigger buffer overflows in the guest operating system driver for that network card, assuming that the host system does not discard such frames (which it will by default) (CVE-2012-6075).

The remote host is affected by the vulnerability described in GLSA-201210-04 (qemu-kvm: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in qemu-kvm. Please review       the CVE identifiers referenced below for details.
  Impact :

    These vulnerabilities allow a remote attacker to cause a Denial of       Service condition on the host server or qemu process, might allow for       arbitrary code execution or a symlink attack when qemu-kvm is in snapshot       mode.
  Workaround :

    There is no known workaround at this time.

Multiple vulnerabilities have been discovered in QEMU, a fast processor emulator. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2012-2652 :
    The snapshot mode of QEMU (-snapshot) incorrectly     handles temporary files used to store the current state,     making it vulnerable to symlink attacks (including     arbitrary file overwriting and guest information     disclosure) due to a race condition.

  - CVE-2012-3515 :
    QEMU does not properly handle VT100 escape sequences     when emulating certain devices with a virtual console     backend. An attacker within a guest with access to the     vulnerable virtual console could overwrite memory of     QEMU and escalate privileges to that of the qemu     process.

Multiple vulnerabilities have been discovered in KVM, a full virtualization solution on x86 hardware. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2012-2652 :
    The snapshot mode of QEMU (-snapshot) incorrectly     handles temporary files used to store the current state,     making it vulnerable to symlink attacks (including     arbitrary file overwriting and guest information     disclosure) due to a race condition.

  - CVE-2012-3515 :
    QEMU does not properly handle VT100 escape sequences     when emulating certain devices with a virtual console     backend. An attacker within a guest with access to the     vulnerable virtual console could overwrite memory of     QEMU and escalate privileges to that of the qemu     process.

- CVE-2012-2652: Possible symlink attacks with -snapshot     (bz 825697, bz 824919)

    - Fix systemtap tapsets (bz 831763)

    - Fix qmp response race caused by spice server bug (bz       744015)

    - Fix text mode screendumps (bz 819155)

    - Don't renable ksm on update (bz 815156)

    - Fix RPM install error on non-virt machines (bz 660629)

    - Obsolete openbios to fix upgrade dependency issues (bz       694802)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

- Fix systemtap tapsets (bz 831763)

    - Fix VNC audio tunnelling (bz 840653)

    - CVE-2012-2652: Possible symlink attacks with -snapshot       (bz 825697, bz 824919)

  - Don't renable ksm on update (bz 815156)

    - Bump usbredir dep (bz 812097)

    - Fix RPM install error on non-virt machines (bz 660629)

    - Obsolete openbios to fix upgrade dependency issues (bz       694802)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that QEMU incorrectly handled temporary files when creating a snapshot. A local attacker could use this flaw to possibly overwrite files with root privilege, or obtain sensitive information from the guest.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
74666	openSUSE Security Update : kvm (openSUSE-SU-2012:0832-1)	Nessus	SuSE Local Security Checks	medium
66133	Mandriva Linux Security Advisory : qemu (MDVSA-2013:121)	Nessus	Mandriva Local Security Checks	high
62634	GLSA-201210-04 : qemu-kvm: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
62016	Debian DSA-2545-1 : qemu - multiple vulnerabilities	Nessus	Debian Local Security Checks	high
62013	Debian DSA-2542-1 : qemu-kvm - multiple vulnerabilities	Nessus	Debian Local Security Checks	high
61472	Fedora 16 : qemu-0.15.1-7.fc16 (2012-11305)	Nessus	Fedora Local Security Checks	medium
61471	Fedora 17 : qemu-1.0.1-1.fc17 (2012-11302)	Nessus	Fedora Local Security Checks	medium
61411	Ubuntu 10.04 LTS / 11.04 / 11.10 / 12.04 LTS : qemu-kvm vulnerability (USN-1522-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2012-2652

high

Tenable Plugins

medium

high

high

high

high

medium

medium

medium