CVE-2010-0428: Input Validation
Izik Eidus found a bug in QEMU that allows priviledged guest user to touch arbitrary memory in the hosting QEMU process. The bug is in QXL/libspice code. Guest and host share region of memory and use it to communicate with each other. Malicious user can use the lack of validation of pointers embedded into data structures in this memory area to touch host's abitrary memory location and/or make the hosting QEMU process crash by dereferencing invalid pointer.
Other sources
libspice, as used in QEMU-KVM in the Hypervisor (aka rhev-hypervisor) in Red Hat Enterprise Virtualization (RHEV) 2.2 and qspice 0.3.0, does not properly validate guest QXL driver pointers, which allows guest OS users to cause a denial of service (invalid pointer dereference and guest OS crash) or possibly gain privileges via unspecified vectors.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-0428?
CVE-2010-0428 is classified as a high severity vulnerability due to its potential for privilege escalation.
How do I fix CVE-2010-0428?
To fix CVE-2010-0428, update to the latest version of Red Hat Enterprise Virtualization or QSPICE that is free of this vulnerability.
What are the implications of exploiting CVE-2010-0428?
Exploitation of CVE-2010-0428 allows a privileged guest user to access and manipulate arbitrary memory within the QEMU host process.
Which software versions are affected by CVE-2010-0428?
CVE-2010-0428 affects Red Hat Enterprise Virtualization 2.2 and QSPICE 0.3.0.
Who reported the CVE-2010-0428 vulnerability?
CVE-2010-0428 was discovered by researcher Izik Eidus.