The change_process_uid function in os-posix.c in Qemu 0.14.0 and earlier does not properly drop group privileges when the -runas option is used, which allows local guest users to access restricted files on the host.

The remote MiracleLinux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2012-478:01 advisory.

    KVM (for Kernel-based Virtual Machine) is a full virtualization solution for Linux on x86 hardware.
    Using KVM, one can run multiple virtual machines running unmodified Linux or Windows images. Each virtual     machine has private virtualized hardware: a network card, disk, graphics adapter, etc.
    Security issues fixed with this release:
     CVE-2011-2527      CVE-2011-4111     No information available at the time of writing, see the CVE link below.
     CVE-2012-0029     Heap-based buffer overflow in the process_tx_desc function in the e1000 emulation (hw/e1000.c) in qemu-kvm     0.12, and possibly other versions, allows guest OS users to cause a denial of service (QEMU crash) and     possibly execute arbitrary code via crafted legacy mode packets.
     No information available at the time of writing, see the CVE link below.
    Fixed bugs:
     qemu-kvm scsi option can be used along the device option. Previously, when set to off, it did not     disable the scsi feature but just hid the feature bit, allowing for malicious users to ignore the feature     bit and issue a request. This scsi=off option can be used to mitigate the virtualization aspect of     CVE-2011-4127 before installing the kernel from <A     HREF=http://www.asianux.com/tsn_hq/index.php?m=errata&a=detail&eid=2720&sType... AXSA:2012-228:02</A>. If     it is already installed, you can skip changing the scsi option.Other wise run the guests by invoking     /usr/libexec/qemu-kvm directly and use the -global virtio-blk-pci.scsi=off option to apply the     mitigation.
    Enhancement:
     qemu-kvm is now built with full RELRO and PIE support.

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2011-1531 advisory.

    - kvm-CVE-2011-2527-os-posix-set-groups-properly-for-runas.patch [bz#722583]
    - CVE: CVE-2011-2527
    - Resolves: bz#713593       (CVE-2011-2212 virtqueue: too-large indirect descriptor buffer overflow [rhel-6.2])
    - CVE: CVE-2011-2212

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A missing initgroups() call for the -runas option has been fixed in kvm (CVE-2011-2527) as well as a buffer overflow in the e1000 device emulation (CVE-2012-0029).

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2011:1531 advisory.

    KVM (Kernel-based Virtual Machine) is a full virtualization solution for     Linux on AMD64 and Intel 64 systems. qemu-kvm is the user-space component     for running virtual machines using KVM.

    It was found that qemu-kvm did not properly drop supplemental group     privileges when the root user started guests from the command line     (/usr/libexec/qemu-kvm) with the -runas option. A qemu-kvm process     started this way could use this flaw to gain access to files on the host     that are accessible to the supplementary groups and not accessible to the     primary group. (CVE-2011-2527)

    Note: This issue only affected qemu-kvm when it was started directly from     the command line. It did not affect the Red Hat Enterprise Virtualization     platform or applications that start qemu-kvm via libvirt, such as the     Virtual Machine Manager (virt-manager).

    This update also fixes several bugs and adds various enhancements.
    Documentation for these bug fixes and enhancements will be available     shortly from the Technical Notes document, linked to in the References     section.

    All users of qemu-kvm are advised to upgrade to these updated packages,     which contain backported patches to correct these issues and add these     enhancements. After installing this update, shut down all running virtual     machines. Once all virtual machines have shut down, start them again for     this update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

- CVE-2011-1750 virtio-blk: heap buffer overflow (bz     698906, bz 698911)

    - CVE-2011-2527 set groups properly for -runas (bz       720773, bz 720784)

    - CVE-2012-0029 e1000 buffer overflow (bz 783984, bz       772075)

    - virtio-blk: refuse SG_IO requests with scsi=off (bz       770135)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The following vulnerabilities have been fixed in KVM :

  - buffer overflow in e1000 device emulation.
    (CVE-2012-0029)

  - missing initgroups() for -runas (CVE-2011-2527)

Andrew Griffiths discovered that QEMU did not correctly drop privileges when using the 'runas' argument. Under certain circumstances a local attacker could exploit this to escalate privileges.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Two vulnerabilities have been discovered in KVM, a solution for full virtualization on x86 hardware :

  - CVE-2011-2212     Nelson Elhage discovered a buffer overflow in the virtio     subsystem, which could lead to denial of service or     privilege escalation.

  - CVE-2011-2527     Andrew Griffiths discovered that group privileges were     insufficiently dropped when started with -runas option,     resulting in privilege escalation.

ID	Name	Product	Family	Severity
284204	MiracleLinux 4 : qemu-kvm-0.12.1.2-2.209.AXS4.4 (AXSA:2012-478:01)	Nessus	Miracle Linux Local Security Checks	critical
181093	Oracle Linux 6 : qemu-kvm (ELSA-2011-1531)	Nessus	Oracle Linux Local Security Checks	medium
75889	openSUSE Security Update : kvm (openSUSE-SU-2012:0207-1)	Nessus	SuSE Local Security Checks	high
64006	RHEL 6 : qemu-kvm (RHSA-2011:1531)	Nessus	Red Hat Local Security Checks	medium
59420	Fedora 15 : qemu-0.14.0-9.fc15 (2012-8604)	Nessus	Fedora Local Security Checks	high
57725	SuSE 11.1 Security Update : KVM (SAT Patch Number 5655)	Nessus	SuSE Local Security Checks	high
55717	Ubuntu 10.04 LTS / 10.10 / 11.04 : qemu-kvm vulnerability (USN-1177-1)	Nessus	Ubuntu Local Security Checks	low
55672	Debian DSA-2282-1 : qemu-kvm - several vulnerabilities	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2011-2527

medium

Tenable Plugins

critical

medium

high

medium

high

high

low

high