Heap-based buffer overflow in the Cirrus VGA implementation in (1) KVM before kvm-82 and (2) QEMU on Debian GNU/Linux and Ubuntu might allow local users to gain privileges by using the VNC console for a connection, aka the LGD-54XX "bitblt" heap overflow. NOTE: this issue exists because of an incorrect fix for CVE-2007-1320.

qemu update to version 0.10.1 fixes the following security issues :

CVE-2008-0928: problems with range checks of block devices CVE-2008-1945: problems with removable media handling CVE-2008-2382:
vnc server DoS CVE-2008-4539: fix a heap overflow in the cirrus VGA implementation CVE-2008-5714: off by one error in vnc password handling

USN-776-1 fixed vulnerabilities in KVM. Due to an incorrect fix, a regression was introduced in Ubuntu 8.04 LTS that caused KVM to fail to boot virtual machines started via libvirt. This update fixes the problem. We apologize for the inconvenience.

Avi Kivity discovered that KVM did not correctly handle certain disk formats. A local attacker could attach a malicious partition that would allow the guest VM to read files on the VM host. (CVE-2008-1945, CVE-2008-2004)

Alfredo Ortega discovered that KVM's VNC protocol handler did not correctly validate certain messages. A remote attacker could send specially crafted VNC messages that would cause KVM to consume CPU resources, leading to a denial of service. (CVE-2008-2382)

Jan Niehusmann discovered that KVM's Cirrus VGA implementation over VNC did not correctly handle certain bitblt operations. A local attacker could exploit this flaw to potentially execute arbitrary code on the VM host or crash KVM, leading to a denial of service. (CVE-2008-4539)

It was discovered that KVM's VNC password checks did not use the correct length. A remote attacker could exploit this flaw to cause KVM to crash, leading to a denial of service.
(CVE-2008-5714).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Avi Kivity discovered that KVM did not correctly handle certain disk formats. A local attacker could attach a malicious partition that would allow the guest VM to read files on the VM host. (CVE-2008-1945, CVE-2008-2004)

Alfredo Ortega discovered that KVM's VNC protocol handler did not correctly validate certain messages. A remote attacker could send specially crafted VNC messages that would cause KVM to consume CPU resources, leading to a denial of service. (CVE-2008-2382)

Jan Niehusmann discovered that KVM's Cirrus VGA implementation over VNC did not correctly handle certain bitblt operations. A local attacker could exploit this flaw to potentially execute arbitrary code on the VM host or crash KVM, leading to a denial of service.
(CVE-2008-4539)

It was discovered that KVM's VNC password checks did not use the correct length. A remote attacker could exploit this flaw to cause KVM to crash, leading to a denial of service. (CVE-2008-5714).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been discovered in the QEMU processor emulator. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2008-0928     Ian Jackson discovered that range checks of file     operations on emulated disk devices were insufficiently     enforced.

  - CVE-2008-1945     It was discovered that an error in the format auto     detection of removable media could lead to the     disclosure of files in the host system.

  - CVE-2008-4539     A buffer overflow has been found in the emulation of the     Cirrus graphics adaptor.

----------------------------------------------------------------------
---------- ChangeLog :

  - Mon Dec 22 2008 Glauber Costa <gcosta at redhat.com> -     65-15.fc9

    - Fixed CVE-2008-2382.

    - Thu Dec 4 2008 Glauber Costa <gcosta at redhat.com> -       65-14.fc9

    - Fixed bug that corrupted gnome-panel #474702

    - Tue Dec 2 2008 Glauber Costa <gcosta at redhat.com> -       65-12.fc9

    - Properly set flags for interrupt return #464304

    - Tue Nov 11 2008 Glauber Costa <gcosta at redhat.com> -       65-11.fc9

    - Fix CVE-2008-4539 #448525

    - Mon Oct 13 2008 Glauber Costa <gcosta at redhat.com> -       65-10.fc9

    - Fix sysenter save in 64-bit hosts #457649

    - Thu Aug 28 2008 Glauber Costa <gcosta at redhat.com> -       65-9.fc9

    - there's already a 65-8 tag

    - Thu Aug 28 2008 Glauber Costa <gcosta at redhat.com> -       65-8.fc9

    - Fixes #459778

    - Fixes #452355

    - Tue May 27 2008 Glauber Costa <gcosta at redhat.com> -       65-7.fc9

    - Fix the build

    - Tue May 27 2008 Glauber Costa <gcosta at redhat.com> -       65-6.fc9

    - Fix Cirrus heap overflow vulnerability (#448525)

    - Fri May 23 2008 Daniel P. Berrange <berrange at       redhat.com> - 65-5.fc9

    - Put PTY in rawmode

    - Tue May 20 2008 Mark McLoughlin <markmc at redhat.com>
      - 65-4.fc9

    - Re-enable patch to fix -kernel with virtio/extboot       drives (#444578)

    - Fri May 16 2008 Glauber Costa <gcosta at redhat.com> -       65-3.fc9

    - Fix problem with cirrus device that was breaking vnc       connections (rhbz #446830)

    - Tue Apr 29 2008 Mark McLoughlin <markmc at redhat.com>
      - 65-2

    - Fix -kernel with virtio/extboot drives (#444578)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Aurelien Jarno reports :

CVE-2008-4539: fix a heap overflow in Cirrus emulation

The code in hw/cirrus_vga.c has changed a lot between CVE-2007-1320 has been announced and the patch has been applied. As a consequence it has wrongly applied and QEMU is still vulnerable to this bug if using VNC.

ID	Name	Product	Family	Severity
40302	openSUSE Security Update : qemu (qemu-691)	Nessus	SuSE Local Security Checks	high
40118	openSUSE Security Update : qemu (qemu-691)	Nessus	SuSE Local Security Checks	high
38777	Ubuntu 8.04 LTS : kvm regression (USN-776-2)	Nessus	Ubuntu Local Security Checks	high
38759	Ubuntu 8.04 LTS / 8.10 : kvm vulnerabilities (USN-776-1)	Nessus	Ubuntu Local Security Checks	high
38747	Debian DSA-1799-1 : qemu - several vulnerabilities	Nessus	Debian Local Security Checks	high
36082	openSUSE 10 Security Update : qemu (qemu-6123)	Nessus	SuSE Local Security Checks	high
35266	Fedora 9 : kvm-65-15.fc9 (2008-11705)	Nessus	Fedora Local Security Checks	high
34685	FreeBSD : qemu -- Heap overflow in Cirrus emulation (07bb3bd2-a920-11dd-8503-0211060005df)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2008-4539

high

Tenable Plugins

high

high

high

high

high

high

high

high