ID CVE-2013-4344
Summary Buffer overflow in the SCSI implementation in QEMU, as used in Xen, when a SCSI controller has more than 256 attached devices, allows local users to gain privileges via a small transfer buffer in a REPORT LUNS command.
References
Vulnerable Configurations
  • QEMU
    cpe:2.3:a:qemu:qemu
  • Xen Xen 3.0.2
    cpe:2.3:o:xen:xen:3.0.2
  • Xen Xen 3.0.3
    cpe:2.3:o:xen:xen:3.0.3
  • Xen Xen 3.0.4
    cpe:2.3:o:xen:xen:3.0.4
  • Xen Xen 3.1.
    cpe:2.3:o:xen:xen:3.1.3
  • Xen Xen 3.1.4
    cpe:2.3:o:xen:xen:3.1.4
  • Xen Xen 3.2.0
    cpe:2.3:o:xen:xen:3.2.0
  • Xen Xen 3.2.1
    cpe:2.3:o:xen:xen:3.2.1
  • Xen Xen 3.2.2
    cpe:2.3:o:xen:xen:3.2.2
  • Xen Xen 3.2.3
    cpe:2.3:o:xen:xen:3.2.3
  • Xen 3.3.0
    cpe:2.3:o:xen:xen:3.3.0
  • Xen 3.3.1
    cpe:2.3:o:xen:xen:3.3.1
  • Xen 3.3.2
    cpe:2.3:o:xen:xen:3.3.2
  • Xen 3.4.0
    cpe:2.3:o:xen:xen:3.4.0
  • Xen 3.4.1
    cpe:2.3:o:xen:xen:3.4.1
  • Xen 3.4.2
    cpe:2.3:o:xen:xen:3.4.2
  • Xen 3.4.3
    cpe:2.3:o:xen:xen:3.4.3
  • Xen 3.4.4
    cpe:2.3:o:xen:xen:3.4.4
  • Xen 4.0.0
    cpe:2.3:o:xen:xen:4.0.0
  • Xen 4.0.1
    cpe:2.3:o:xen:xen:4.0.1
  • Xen 4.0.2
    cpe:2.3:o:xen:xen:4.0.2
  • Xen 4.0.3
    cpe:2.3:o:xen:xen:4.0.3
  • Xen 4.0.4
    cpe:2.3:o:xen:xen:4.0.4
  • Xen 4.1.0
    cpe:2.3:o:xen:xen:4.1.0
  • Xen 4.1.1
    cpe:2.3:o:xen:xen:4.1.1
  • Xen 4.1.2
    cpe:2.3:o:xen:xen:4.1.2
  • Xen 4.1.3
    cpe:2.3:o:xen:xen:4.1.3
  • Xen 4.1.4
    cpe:2.3:o:xen:xen:4.1.4
  • Xen 4.1.5
    cpe:2.3:o:xen:xen:4.1.5
  • Xen 4.2.0
    cpe:2.3:o:xen:xen:4.2.0
  • Xen 4.2.1
    cpe:2.3:o:xen:xen:4.2.1
  • Xen 4.2.2
    cpe:2.3:o:xen:xen:4.2.2
  • Xen 4.2.3
    cpe:2.3:o:xen:xen:4.2.3
  • Xen Xen 4.3.0
    cpe:2.3:o:xen:xen:4.3.0
  • OpenSUSE 12.3
    cpe:2.3:o:opensuse:opensuse:12.3
  • OpenSUSE 13.1
    cpe:2.3:o:opensuse:opensuse:13.1
CVSS
Base: 6.0 (as of 20-11-2015 - 10:36)
Impact:
Exploitability:
CWE CWE-119
CAPEC
  • Buffer Overflow via Environment Variables
    This attack pattern involves causing a buffer overflow through manipulation of environment variables. Once the attacker finds that they can modify an environment variable, they may try to overflow associated buffers. This attack leverages implicit trust often placed in environment variables.
  • Overflow Buffers
    Buffer Overflow attacks target improper or missing bounds checking on buffer operations, typically triggered by input injected by an attacker. As a consequence, an attacker is able to write past the boundaries of allocated buffer regions in memory, causing a program crash or potentially redirection of execution as per the attackers' choice.
  • Client-side Injection-induced Buffer Overflow
    This type of attack exploits a buffer overflow vulnerability in targeted client software through injection of malicious content from a custom-built hostile service.
  • Filter Failure through Buffer Overflow
    In this attack, the idea is to cause an active filter to fail by causing an oversized transaction. An attacker may try to feed overly long input strings to the program in an attempt to overwhelm the filter (by causing a buffer overflow) and hoping that the filter does not fail securely (i.e. the user input is let into the system unfiltered).
  • MIME Conversion
    An attacker exploits a weakness in the MIME conversion routine to cause a buffer overflow and gain control over the mail server machine. The MIME system is designed to allow various different information formats to be interpreted and sent via e-mail. Attack points exist when data are converted to MIME compatible format and back.
  • Overflow Binary Resource File
    An attack of this type exploits a buffer overflow vulnerability in the handling of binary resources. Binary resources may include music files like MP3, image files like JPEG files, and any other binary file. These attacks may pass unnoticed to the client machine through normal usage of files, such as a browser loading a seemingly innocent JPEG file. This can allow the attacker access to the execution stack and execute arbitrary code in the target process. This attack pattern is a variant of standard buffer overflow attacks using an unexpected vector (binary files) to wrap its attack and open up a new attack vector. The attacker is required to either directly serve the binary content to the victim, or place it in a locale like a MP3 sharing application, for the victim to download. The attacker then is notified upon the download or otherwise locates the vulnerability opened up by the buffer overflow.
  • Buffer Overflow via Symbolic Links
    This type of attack leverages the use of symbolic links to cause buffer overflows. An attacker can try to create or manipulate a symbolic link file such that its contents result in out of bounds data. When the target software processes the symbolic link file, it could potentially overflow internal buffers with insufficient bounds checking.
  • Overflow Variables and Tags
    This type of attack leverages the use of tags or variables from a formatted configuration data to cause buffer overflow. The attacker crafts a malicious HTML page or configuration file that includes oversized strings, thus causing an overflow.
  • Buffer Overflow via Parameter Expansion
    In this attack, the target software is given input that the attacker knows will be modified and expanded in size during processing. This attack relies on the target software failing to anticipate that the expanded data may exceed some internal limit, thereby creating a buffer overflow.
  • Buffer Overflow in an API Call
    This attack targets libraries or shared code modules which are vulnerable to buffer overflow attacks. An attacker who has access to an API may try to embed malicious code in the API function call and exploit a buffer overflow vulnerability in the function's implementation. All clients that make use of the code library thus become vulnerable by association. This has a very broad effect on security across a system, usually affecting more than one software process.
  • Buffer Overflow in Local Command-Line Utilities
    This attack targets command-line utilities available in a number of shells. An attacker can leverage a vulnerability found in a command-line utility to escalate privilege to root.
Access
VectorComplexityAuthentication
LOCAL HIGH SINGLE_INSTANCE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
nessus via4
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_KVM-140416.NASL
    description The QEMU embedded within KVM received various security fixes. Various issues in the block layer have been fixed : - A virtio security issue in config io space handling. (CVE-2013-2016) - A SCSI report LUNs buffer overflow. (CVE-2013-4344) - A buffer overflow in the QEMU USB stack. (CVE-2013-4541)
    last seen 2018-09-01
    modified 2014-11-06
    plugin id 73939
    published 2014-05-09
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=73939
    title SuSE 11.3 Security Update : kvm (SAT Patch Number 9142)
  • NASL family Ubuntu Local Security Checks
    NASL id UBUNTU_USN-2092-1.NASL
    description Asias He discovered that QEMU incorrectly handled SCSI controllers with more than 256 attached devices. A local user could possibly use this flaw to elevate privileges. (CVE-2013-4344) It was discovered that QEMU incorrectly handled Xen disks. A local guest could possibly use this flaw to consume resources, resulting in a denial of service. This issue only affected Ubuntu 12.10 and Ubuntu 13.10. (CVE-2013-4375) Sibiao Luo discovered that QEMU incorrectly handled device hot-unplugging. A local user could possibly use this flaw to cause a denial of service. This issue only affected Ubuntu 13.10. (CVE-2013-4377). Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2018-12-01
    plugin id 72231
    published 2014-01-31
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=72231
    title Ubuntu 12.04 LTS / 12.10 / 13.10 : qemu, qemu-kvm vulnerabilities (USN-2092-1)
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2013-18715.NASL
    description - Fix migration from qemu <= 1.5 - Rebase to pending 1.6.1 stable - CVE-2013-4377: Fix crash when unplugging virtio devices (bz #1012633, bz #1012641) - Fix 'new snapshot' slowness after the first snap (bz #988436) - Fix 9pfs xattrs on kernel 3.11 (bz #1013676) - CVE-2013-4344: buffer overflow in scsi_target_emulate_report_luns (bz #1015274, bz #1007330) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2015-10-19
    plugin id 70432
    published 2013-10-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=70432
    title Fedora 20 : qemu-1.6.0-10.fc20 (2013-18715)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2014-111.NASL
    description Running QEMU in a configuration with more than 256 emulated SCSI devices attached could have caused a buffer overflow when the guest issues a REPORT LUNS command. Fix this as part of upgrading to the latest stable version on 13.1. Also fix unintentional building against gtk2 rather than gtk3 on 13.1, and fix serial retry logic on 12.3.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 75249
    published 2014-06-13
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=75249
    title openSUSE Security Update : qemu (openSUSE-SU-2014:0200-1)
  • NASL family Oracle Linux Local Security Checks
    NASL id ORACLELINUX_ELSA-2013-1553.NASL
    description From Red Hat Security Advisory 2013:1553 : Updated qemu-kvm packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on AMD64 and Intel 64 systems that is built into the standard Red Hat Enterprise Linux kernel. The qemu-kvm packages form the user-space component for running virtual machines using KVM. A buffer overflow flaw was found in the way QEMU processed the SCSI 'REPORT LUNS' command when more than 256 LUNs were specified for a single SCSI target. A privileged guest user could use this flaw to corrupt QEMU process memory on the host, which could potentially result in arbitrary code execution on the host with the privileges of the QEMU process. (CVE-2013-4344) This issue was discovered by Asias He of Red Hat. These updated qemu-kvm packages include numerous bug fixes and various enhancements. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Enterprise Linux 6.5 Technical Notes, linked to in the References, for information on the most significant of these changes. All qemu-kvm users are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add these enhancements. After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.
    last seen 2019-02-21
    modified 2018-07-18
    plugin id 71127
    published 2013-11-29
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=71127
    title Oracle Linux 6 : qemu-kvm (ELSA-2013-1553)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2013-1553.NASL
    description Updated qemu-kvm packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on AMD64 and Intel 64 systems that is built into the standard Red Hat Enterprise Linux kernel. The qemu-kvm packages form the user-space component for running virtual machines using KVM. A buffer overflow flaw was found in the way QEMU processed the SCSI 'REPORT LUNS' command when more than 256 LUNs were specified for a single SCSI target. A privileged guest user could use this flaw to corrupt QEMU process memory on the host, which could potentially result in arbitrary code execution on the host with the privileges of the QEMU process. (CVE-2013-4344) This issue was discovered by Asias He of Red Hat. These updated qemu-kvm packages include numerous bug fixes and various enhancements. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Enterprise Linux 6.5 Technical Notes, linked to in the References, for information on the most significant of these changes. All qemu-kvm users are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add these enhancements. After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 71004
    published 2013-11-21
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=71004
    title RHEL 6 : qemu-kvm (RHSA-2013:1553)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2013-1754.NASL
    description Updated qemu-kvm-rhev, qemu-kvm-rhev-tools, and qemu-img-rhev packages are now available. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on AMD64 and Intel 64 systems. The qemu-kvm-rhev package provides the user-space component for running virtual machines using KVM, in environments managed by Red Hat Enterprise Virtualization Manager. A buffer overflow flaw was found in the way QEMU processed the SCSI 'REPORT LUNS' command when more than 256 LUNs were specified for a single SCSI target. A privileged guest user could use this flaw to corrupt QEMU process memory on the host, which could potentially result in arbitrary code execution on the host with the privileges of the QEMU process. (CVE-2013-4344) This issue was discovered by Asias He of Red Hat. This update fixes the following bugs : * In QMP monitor, if an attempt was made to create an image with the same file name as the backing file, an error was generated, but no message was displayed. Performing this action in QMP Monitor now generates the same error message as performing the action in HMP: 'Error: Trying to create an image with the same file name as the backing file'. (BZ#877240) * QEMU I/O throttling has been disabled in Red Hat Enterprise Linux and is now only available enabled in the Red Hat Enterprise Virtualization QEMU package (qemu-kvm-rhev). (BZ#975468) * When booting a guest machine, it would still boot when specifying iops and bps as a negative value, without displaying an error message. This has been fixed so that if a negative value is used the guest does not boot and QEMU exits with the following message 'bps and iops values must be 0 or greater'. (BZ#987725) * When booting a guest with QMP server, hot plug was failing. It can now do hotplug with QEMU I/O throttling including iops, iops_wr, iops_rd, bps, bps_wr, bps_rd inofs successfully. (BZ#987745) * Due to a change in virtualization features, all fixes and errata related to Red Hat Enterprise Virtualization specific features, can only be posted to the Red Hat Enterprise Virtualization channel. Therefore a Red Hat Enterprise Virtualization specific qemu-kvm (for RHEV-H-6.5.0 Errata) was developed. This meant that the qemu-kvm-rhev binary was mapped to a Red Had enterprise Virtualization channel, entitled to Red Hat Enterprise Virtualization customers, and disabled from the Red Hat Enterprise Linux channel. (BZ#997032) * The qemu-kvm-rhev package now contains /usr/lib64/qemu, as this directory is where CEPH packages provide librbd to be used by QEMU at runtime. (BZ#999705) * QEMU performed a core dump when iops.bps was set to a negative value. This has been fixed so that it no longer performs a core dump when a negative value is entered, instead an error message is displayed indicating the values must be zero of greater. (BZ#1001436) * When running the 'rpm -V qemu-kvm-rhev' command, an error was generated stating there were unsatisfied dependencies. This has been fixed so there now are no unsatisfied dependencies and it executes correctly. (BZ#1010930) In addition, this update adds the following enhancements : * QEMU I/O throttling allows for finer control of the rate of I/O operations at the QEMU level, and is therefore independent of the underlying storage device. A similar feature can be created by using cgroups at the libvirt level, but cgroups is limited as it does not support some storage devices (such as image files over NFS) and throttles the whole virtual machine, including access to meta-data, while qemu I/O is more fine-grained. (BZ#956825) * Patches were added to the QEMU block driver for accessing CEPH storage on qemu-kvm-rhev. However,this is not usable on its own, a librbd library still needs to be provided. The librbd library is not provided in Red Hat Enterprise Linux and will be handled by a third party source. (BZ#988079)
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 78981
    published 2014-11-08
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=78981
    title RHEL 6 : qemu-kvm-rhev, qemu-kvm-rhev-tools, qemu-img-rhev (RHSA-2013:1754)
  • NASL family Scientific Linux Local Security Checks
    NASL id SL_20131121_QEMU_KVM_ON_SL6_X.NASL
    description A buffer overflow flaw was found in the way QEMU processed the SCSI 'REPORT LUNS' command when more than 256 LUNs were specified for a single SCSI target. A privileged guest user could use this flaw to corrupt QEMU process memory on the host, which could potentially result in arbitrary code execution on the host with the privileges of the QEMU process. (CVE-2013-4344) After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.
    last seen 2019-02-21
    modified 2018-12-31
    plugin id 71299
    published 2013-12-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=71299
    title Scientific Linux Security Update : qemu-kvm on SL6.x i386/x86_64
  • NASL family CentOS Local Security Checks
    NASL id CENTOS_RHSA-2013-1553.NASL
    description Updated qemu-kvm packages that fix one security issue, several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 6. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. KVM (Kernel-based Virtual Machine) is a full virtualization solution for Linux on AMD64 and Intel 64 systems that is built into the standard Red Hat Enterprise Linux kernel. The qemu-kvm packages form the user-space component for running virtual machines using KVM. A buffer overflow flaw was found in the way QEMU processed the SCSI 'REPORT LUNS' command when more than 256 LUNs were specified for a single SCSI target. A privileged guest user could use this flaw to corrupt QEMU process memory on the host, which could potentially result in arbitrary code execution on the host with the privileges of the QEMU process. (CVE-2013-4344) This issue was discovered by Asias He of Red Hat. These updated qemu-kvm packages include numerous bug fixes and various enhancements. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Enterprise Linux 6.5 Technical Notes, linked to in the References, for information on the most significant of these changes. All qemu-kvm users are advised to upgrade to these updated packages, which contain backported patches to correct these issues and add these enhancements. After installing this update, shut down all running virtual machines. Once all virtual machines have shut down, start them again for this update to take effect.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 79161
    published 2014-11-12
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=79161
    title CentOS 6 : qemu-kvm (CESA-2013:1553)
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-2932.NASL
    description Several vulnerabilities were discovered in qemu, a fast processor emulator. - CVE-2013-4344 Buffer overflow in the SCSI implementation in QEMU, when a SCSI controller has more than 256 attached devices, allows local users to gain privileges via a small transfer buffer in a REPORT LUNS command. - CVE-2014-2894 Off-by-one error in the cmd_smart function in the smart self test in hw/ide/core.c in QEMU allows local users to have unspecified impact via a SMART EXECUTE OFFLINE command that triggers a buffer underflow and memory corruption.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 74095
    published 2014-05-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=74095
    title Debian DSA-2932-1 : qemu - security update
  • NASL family Debian Local Security Checks
    NASL id DEBIAN_DSA-2933.NASL
    description Several vulnerabilities were discovered in qemu-kvm, a full virtualization solution on x86 hardware. - CVE-2013-4344 Buffer overflow in the SCSI implementation in QEMU, when a SCSI controller has more than 256 attached devices, allows local users to gain privileges via a small transfer buffer in a REPORT LUNS command. - CVE-2014-2894 Off-by-one error in the cmd_smart function in the smart self test in hw/ide/core.c in QEMU allows local users to have unspecified impact via a SMART EXECUTE OFFLINE command that triggers a buffer underflow and memory corruption.
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 74096
    published 2014-05-20
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=74096
    title Debian DSA-2933-1 : qemu-kvm - security update
  • NASL family Fedora Local Security Checks
    NASL id FEDORA_2013-18493.NASL
    description - CVE-2013-4344: buffer overflow in scsi_target_emulate_report_luns (bz #1015274, bz #1007330) - Fix 9pfs xattrs on kernel 3.11 (bz #1013676) - Require newer ceph-libs to fix symbol error (bz #995883) Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
    last seen 2019-02-21
    modified 2015-10-19
    plugin id 70430
    published 2013-10-15
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=70430
    title Fedora 19 : qemu-1.4.2-12.fc19 (2013-18493)
  • NASL family SuSE Local Security Checks
    NASL id SUSE_11_XEN-201409-141002.NASL
    description The SUSE Linux Enterprise 11 Service Pack 3 Xen package was updated to fix various bugs and security issues. The following security issues have been fixed : - XSA-108: CVE-2014-7188: Improper MSR range used for x2APIC emulation. (bnc#897657) - XSA-106: CVE-2014-7156: Missing privilege level checks in x86 emulation of software interrupts. (bnc#895802) - XSA-105: CVE-2014-7155: Missing privilege level checks in x86 HLT, LGDT, LIDT, and LMSW emulation. (bnc#895799) - XSA-104: CVE-2014-7154: Race condition in HVMOP_track_dirty_vram. (bnc#895798) - XSA-100: CVE-2014-4021: Hypervisor heap contents leaked to guests. (bnc#880751) - XSA-96: CVE-2014-3967 / CVE-2014-3968: Vulnerabilities in HVM MSI injection. (bnc#878841) - XSA-89: CVE-2014-2599: HVMOP_set_mem_access is not preemptible. (bnc#867910) - XSA-65: CVE-2013-4344: qemu SCSI REPORT LUNS buffer overflow. (bnc#842006) - qemu: zaurus: buffer overrun on invalid state load (bnc#864801) The following non-security issues have been fixed:. (CVE-2013-4540) - xend: Fix netif convertToDeviceNumber for running domains. (bnc#891539) - Installing SLES12 as a VM on SLES11 SP3 fails because of btrfs in the VM. (bnc#882092) - XEN kernel panic do_device_not_available(). (bnc#881900) - Boot Failure with xen kernel in UEFI mode with error 'No memory for trampoline'. (bnc#833483) - SLES 11 SP3 vm-install should get RHEL 7 support when released. (bnc#862608) - SLES 11 SP3 XEN kiso version cause softlockup on 8 blades npar(480 cpu). (bnc#858178) - Local attach support for PHY backends using scripts local_attach_support_for_phy.patch. (bnc#865682) - Improve multipath support for npiv devices block-npiv (bnc#798770)
    last seen 2019-02-21
    modified 2014-10-23
    plugin id 78652
    published 2014-10-23
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=78652
    title SuSE 11.3 Security Update : Xen (SAT Patch Number 9828)
  • NASL family Red Hat Local Security Checks
    NASL id REDHAT-RHSA-2013-1527.NASL
    description An updated rhev-hypervisor6 package that fixes multiple security issues and one bug is now available. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. The rhev-hypervisor6 package provides a Red Hat Enterprise Virtualization Hypervisor ISO disk image. The Red Hat Enterprise Virtualization Hypervisor is a dedicated Kernel-based Virtual Machine (KVM) hypervisor. It includes everything necessary to run and manage virtual machines: a subset of the Red Hat Enterprise Linux operating environment and the Red Hat Enterprise Virtualization Agent. Note: Red Hat Enterprise Virtualization Hypervisor is only available for the Intel 64 and AMD64 architectures with virtualization extensions. Upgrade Note: If you upgrade the Red Hat Enterprise Virtualization Hypervisor through the 3.2 Manager administration portal, the Host may appear with the status of 'Install Failed'. If this happens, place the host into maintenance mode, then activate it again to get the host back to an 'Up' state. A buffer overflow flaw was found in the way QEMU processed the SCSI 'REPORT LUNS' command when more than 256 LUNs were specified for a single SCSI target. A privileged guest user could use this flaw to corrupt QEMU process memory on the host, which could potentially result in arbitrary code execution on the host with the privileges of the QEMU process. (CVE-2013-4344) Multiple flaws were found in the way Linux kernel handled HID (Human Interface Device) reports. An attacker with physical access to the system could use this flaw to crash the system or, potentially, escalate their privileges on the system. (CVE-2013-2888, CVE-2013-2889, CVE-2013-2892) A flaw was found in the way the Python SSL module handled X.509 certificate fields that contain a NULL byte. An attacker could potentially exploit this flaw to conduct man-in-the-middle attacks to spoof SSL servers. Note that to exploit this issue, an attacker would need to obtain a carefully crafted certificate signed by an authority that the client trusts. (CVE-2013-4238) The default OpenSSH configuration made it easy for remote attackers to exhaust unauthorized connection slots and prevent other users from being able to log in to a system. This flaw has been addressed by enabling random early connection drops by setting MaxStartups to 10:30:100 by default. For more information, refer to the sshd_config(5) man page. (CVE-2010-5107) The CVE-2013-4344 issue was discovered by Asias He of Red Hat. This updated package provides updated components that include fixes for various security issues. These issues have no security impact on Red Hat Enterprise Virtualization Hypervisor itself, however. The security fixes included in this update address the following CVE numbers : CVE-2012-0786 and CVE-2012-0787 (augeas issues) CVE-2013-1813 (busybox issue) CVE-2013-0221, CVE-2013-0222, and CVE-2013-0223 (coreutils issues) CVE-2012-4453 (dracut issue) CVE-2013-4332, CVE-2013-0242, and CVE-2013-1914 (glibc issues) CVE-2013-4387, CVE-2013-0343, CVE-2013-4345, CVE-2013-4591, CVE-2013-4592, CVE-2012-6542, CVE-2013-3231, CVE-2013-1929, CVE-2012-6545, CVE-2013-1928, CVE-2013-2164, CVE-2013-2234, and CVE-2013-2851 (kernel issues) CVE-2013-4242 (libgcrypt issue) CVE-2013-4419 (libguestfs issue) CVE-2013-1775, CVE-2013-2776, and CVE-2013-2777 (sudo issues) This update also fixes the following bug : * A previous version of the rhev-hypervisor6 package did not contain the latest vhostmd package, which provides a 'metrics communication channel' between a host and its hosted virtual machines, allowing limited introspection of host resource usage from within virtual machines. This has been fixed, and rhev-hypervisor6 now includes the latest vhostmd package. (BZ#1026703) This update also contains the fixes from the following errata : * ovirt-node: https://rhn.redhat.com/errata/RHBA-2013-1528.html Users of the Red Hat Enterprise Virtualization Hypervisor are advised to upgrade to this updated package, which corrects these issues.
    last seen 2019-02-21
    modified 2018-12-20
    plugin id 78979
    published 2014-11-08
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=78979
    title RHEL 6 : rhev-hypervisor6 (RHSA-2013:1527)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2014-579.NASL
    description XEN was updated to fix various bugs and security issues. Security issues fixed : - bnc#897657 - CVE-2014-7188: XSA-108 Improper MSR range used for x2APIC emulation - bnc#895802 - CVE-2014-7156: XSA-106: Missing privilege level checks in x86 emulation of software interrupts - bnc#895799 - CVE-2014-7155: XSA-105: Missing privilege level checks in x86 HLT, LGDT, LIDT, and LMSW emulation - bnc#895798 - CVE-2014-7154: XSA-104: Race condition in HVMOP_track_dirty_vram - bnc#864801 - CVE-2013-4540: qemu: zaurus: buffer overrun on invalid state load - bnc#880751 - CVE-2014-4021: XSA-100: Hypervisor heap contents leaked to guests - bnc#878841 - CVE-2014-3967,CVE-2014-3968: XSA-96: Vulnerabilities in HVM MSI injection - bnc#867910 - CVE-2014-2599: XSA-89: HVMOP_set_mem_access is not preemptible - bnc#842006 - CVE-2013-4344: XSA-65: xen: qemu SCSI REPORT LUNS buffer overflow Other bugs fixed : - bnc#896023 - Adjust xentop column layout - bnc#891539 - xend: fix netif convertToDeviceNumber for running domains - bnc#820873 - The 'long' option doesn't work with 'xl list' - bnc#881900 - XEN kernel panic do_device_not_available() - bnc#833483 - Boot Failure with xen kernel in UEFI mode with error 'No memory for trampoline' - bnc#862608 - SLES 11 SP3 vm-install should get RHEL 7 support when released - bnc#858178 - [HP HPS Bug]: SLES11sp3 XEN kiso version cause softlockup on 8 blades npar(480 cpu) - bnc#865682 - Local attach support for PHY backends using scripts - bnc#798770 - Improve multipath support for npiv devices
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 78116
    published 2014-10-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=78116
    title openSUSE Security Update : xen (openSUSE-SU-2014:1279-1)
  • NASL family SuSE Local Security Checks
    NASL id OPENSUSE-2014-580.NASL
    description XEN was updated to fix security issues and bugs. Security issues fixed : - bnc#897657 - CVE-2014-7188: XSA-108 Improper MSR range used for x2APIC emulation - bnc#895802 - CVE-2014-7156: XSA-106: Missing privilege level checks in x86 emulation of software interrupts - bnc#895799 - CVE-2014-7155: XSA-105: Missing privilege level checks in x86 HLT, LGDT, LIDT, and LMSW emulation - bnc#895798 - CVE-2014-7154: XSA-104: Race condition in HVMOP_track_dirty_vram - bnc#864801 - CVE-2013-4540: qemu: zaurus: buffer overrun on invalid state load - bnc#875668 - CVE-2014-3124: XSA-92: HVMOP_set_mem_type allows invalid P2M entries to be created - bnc#878841 - CVE-2014-3967, CVE-2014-3968: XSA-96: Xen: Vulnerabilities in HVM MSI injection - bnc#880751 - CVE-2014-4021: XSA-100: Hypervisor heap contents leaked to guests - bnc#842006 - CVE-2013-4344: XSA-65: xen: qemu SCSI REPORT LUNS buffer overflow Other bugs fixed : - bnc#896023 - Adjust xentop column layout - bnc#820873 - The 'long' option doesn't work with 'xl list' - bnc#882127 - Xen kernel panics on booting SLES12 Beta 8 - bnc#865682 - Local attach support for PHY backends using scripts - bnc#798770 - Improve multipath support for npiv devices
    last seen 2019-02-21
    modified 2018-11-10
    plugin id 78117
    published 2014-10-10
    reporter Tenable
    source https://www.tenable.com/plugins/index.php?view=single&id=78117
    title openSUSE Security Update : xen (openSUSE-SU-2014:1281-1)
redhat via4
advisories
  • bugzilla
    id 1022821
    title "
    oval
    AND
    • OR
      • comment Red Hat Enterprise Linux 6 Client is installed
        oval oval:com.redhat.rhba:tst:20111656001
      • comment Red Hat Enterprise Linux 6 Server is installed
        oval oval:com.redhat.rhba:tst:20111656002
      • comment Red Hat Enterprise Linux 6 Workstation is installed
        oval oval:com.redhat.rhba:tst:20111656003
      • comment Red Hat Enterprise Linux 6 ComputeNode is installed
        oval oval:com.redhat.rhba:tst:20111656004
    • OR
      • AND
        • comment qemu-guest-agent is earlier than 2:0.12.1.2-2.415.el6
          oval oval:com.redhat.rhsa:tst:20131553007
        • comment qemu-guest-agent is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20121234008
      • AND
        • comment qemu-img is earlier than 2:0.12.1.2-2.415.el6
          oval oval:com.redhat.rhsa:tst:20131553011
        • comment qemu-img is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110345008
      • AND
        • comment qemu-kvm is earlier than 2:0.12.1.2-2.415.el6
          oval oval:com.redhat.rhsa:tst:20131553005
        • comment qemu-kvm is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110345006
      • AND
        • comment qemu-kvm-tools is earlier than 2:0.12.1.2-2.415.el6
          oval oval:com.redhat.rhsa:tst:20131553009
        • comment qemu-kvm-tools is signed with Red Hat redhatrelease2 key
          oval oval:com.redhat.rhsa:tst:20110345010
    rhsa
    id RHSA-2013:1553
    released 2013-11-21
    severity Important
    title RHSA-2013:1553: qemu-kvm security, bug fix, and enhancement update (Important)
  • rhsa
    id RHSA-2013:1754
rpms
  • qemu-guest-agent-2:0.12.1.2-2.415.el6
  • qemu-img-2:0.12.1.2-2.415.el6
  • qemu-kvm-2:0.12.1.2-2.415.el6
  • qemu-kvm-tools-2:0.12.1.2-2.415.el6
refmap via4
bid 62773
mlist
  • [oss-security] 20131002 Xen Security Advisory 65 (CVE-2013-4344) - qemu SCSI REPORT LUNS buffer overflow
  • [qemu-devel] 20131009 [ANNOUNCE] QEMU 1.6.1 Stable released
osvdb 98028
suse
  • openSUSE-SU-2014:1279
  • openSUSE-SU-2014:1281
ubuntu USN-2092-1
Last major update 20-11-2015 - 10:58
Published 04-10-2013 - 13:55
Last modified 30-10-2018 - 12:27
Back to Top