QEMU Affected By Another Security Vulnerability
Written by Michael Larabel in Linux Security on 10 June 2015 at 11:07 AM EDT. 3 Comments
LINUX SECURITY --
Back in May a security vulnerability went public that let VMs escape QEMU's security and gain access to the host via an issue in QEMU's virtual floppy disk driver code. Another QEMU security issue is going public today.

CVE-2015-3209 is the new QEMU vulnerability going public today whereby a heap overflow could happen within the PCNET controller and allow a guest to host scape.

Per the details in the advisory, "A guest which has access to an emulated PCNET network device (e.g. with 'model=pcnet' in their VIF configuration) can exploit this vulnerability to take over the qemu process elevating its privilege to that of the qemu process."

QEMU patches are available to address this vulnerability in this important piece of the open-source Linux virtualization stack.
Related News
About The Author
Author picture

Michael Larabel is the principal author of Phoronix.com and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 20,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and OpenBenchmarking.org automated benchmarking software. He can be followed via Twitter or contacted via MichaelLarabel.com.

Popular News This Week