The virtio_queue_notify in qemu-kvm 0.14.0 and earlier does not properly validate the virtqueue number, which allows guest users to cause a denial of service (guest crash) and possibly execute arbitrary code via a negative number in the Queue Notify field of the Virtio Header, which bypasses a signed comparison.

A privileged guest user could cause a buffer overflow in the virtio subsystem of the host, therefore crashing the guest or potentially execute arbitrary code on the host (CVE-2011-2212, CVE-2011-2512).

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-0919 advisory.

    [qemu-kvm-0.12.1.2-2.160.el6_1.2]
    - kvm-virtio-guard-against-negative-vq-notifies.patch [bz#717403]
    - Resolves: bz#717403       (qemu-kvm: OOB memory access caused by negative vq notifies [rhel-6.1.z])

    [qemu-kvm-0.12.1.2-2.160.el6_1]
    - kvm-Fix-phys-memory-client-pass-guest-physical-address-n.patch [bz#701771]
    - kvm-virtio-prevent-indirect-descriptor-buffer-overflow.patch [bz#713592]
    - Resolves: bz#701771       (Fix phys memory client for vhost)
    - Resolves: bz#713592       (EMBARGOED CVE-2011-2212 virtqueue: too-large indirect descriptor buffer overflow [rhel-6.1.z])

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2011:0919 advisory.

    KVM (Kernel-based Virtual Machine) is a full virtualization solution for     Linux on AMD64 and Intel 64 systems. qemu-kvm is the user-space component     for running virtual machines using KVM.

    It was found that the virtio subsystem in qemu-kvm did not properly     validate virtqueue in and out requests from the guest. A privileged guest     user could use this flaw to trigger a buffer overflow, allowing them to     crash the guest (denial of service) or, possibly, escalate their privileges     on the host. (CVE-2011-2212)

    It was found that the virtio_queue_notify() function in qemu-kvm did not     perform sufficient input validation on the value later used as an index     into the array of virtqueues. An unprivileged guest user could use this     flaw to crash the guest (denial of service) or, possibly, escalate their     privileges on the host. (CVE-2011-2512)

    Red Hat would like to thank Nelson Elhage for reporting CVE-2011-2212.

    This update also fixes the following bug:

    * A bug was found in the way vhost (in qemu-kvm) set up mappings with the     host kernel's vhost module. This could result in the host kernel's vhost     module not having a complete view of a guest system's memory, if that guest     had more than 4 GB of memory. Consequently, hot plugging a vhost-net     network device and restarting the guest may have resulted in that device no     longer working. (BZ#701771)

    All users of qemu-kvm should upgrade to these updated packages, which     contain backported patches to resolve these issues. After installing this     update, shut down all running virtual machines. Once all virtual machines     have shut down, start them again for this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201210-04 (qemu-kvm: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in qemu-kvm. Please review       the CVE identifiers referenced below for details.
  Impact :

    These vulnerabilities allow a remote attacker to cause a Denial of       Service condition on the host server or qemu process, might allow for       arbitrary code execution or a symlink attack when qemu-kvm is in snapshot       mode.
  Workaround :

    There is no known workaround at this time.

A privileged guest user could cause a buffer overflow in the virtio subsystem of the host, therefore crashing the guest or potentially execute arbitrary code on the host. (CVE-2011-2212 / CVE-2011-2512)

Nelson Elhage discoverd that QEMU did not properly validate certain virtqueue requests from the guest. An attacker could exploit this to cause a denial of service of the guest or possibly execute code with the privileges of the user invoking the program. (CVE-2011-2212)

Stefan Hajnoczi discovered that QEMU did not properly perform integer comparisons when performing virtqueue input validation. An attacker could exploit this to cause a denial of service of the guest or possibly execute code with the privileges of the user invoking the program. (CVE-2011-2512)

When using QEMU with libvirt or virtualization management software based on libvirt such as Eucalyptus and OpenStack, QEMU guests are individually isolated by an AppArmor profile by default in Ubuntu.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that incorrect sanitising of virtio queue commands in KVM, a solution for full virtualization on x86 hardware, could lead to denial of service or the execution of arbitrary code.

The oldstable distribution (lenny) is not affected by this problem.

ID	Name	Product	Family	Severity
75888	openSUSE Security Update : kvm (openSUSE-SU-2011:0803-1)	Nessus	SuSE Local Security Checks	high
75567	openSUSE Security Update : kvm (openSUSE-SU-2011:0803-1)	Nessus	SuSE Local Security Checks	high
68301	Oracle Linux 6 : qemu-kvm (ELSA-2011-0919)	Nessus	Oracle Linux Local Security Checks	critical
63987	RHEL 6 : qemu-kvm (RHSA-2011:0919)	Nessus	Red Hat Local Security Checks	critical
62634	GLSA-201210-04 : qemu-kvm: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
55620	SuSE 11.1 Security Update : KVM (SAT Patch Number 4814)	Nessus	SuSE Local Security Checks	high
55531	Ubuntu 10.04 LTS / 10.10 / 11.04 : qemu-kvm vulnerabilities (USN-1165-1)	Nessus	Ubuntu Local Security Checks	high
55490	Debian DSA-2270-1 : qemu-kvm - programming error	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2011-2512

critical

Tenable Plugins

high

high

critical

critical

high

high

high

medium