CVE-2010-0431: Input Validation
Izik Eidus found a bug in QEMU that allows priviledged guest user to touch arbitrary memory in the hosting QEMU process. The bug is in QXL code. Guest and host share region of memory and use it to communicate with each other. Malicious user can use the lack of validation of pointers embedded into data structures in this memory area to touch host's abitrary memory location and/or make the hosting QEMU process crash by dereferencing invalid pointer.
Other sources
QEMU-KVM, as used in the Hypervisor (aka rhev-hypervisor) in Red Hat Enterprise Virtualization (RHEV) 2.2 and KVM 83, does not properly validate guest QXL driver pointers, which allows guest OS users to cause a denial of service (invalid pointer dereference and guest OS crash) or possibly gain privileges via unspecified vectors.
— MITRE
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-0431?
CVE-2010-0431 is considered a high severity vulnerability due to the potential for privileged guest users to access arbitrary memory in the host QEMU process.
How do I fix CVE-2010-0431?
To mitigate CVE-2010-0431, it is recommended to update to the latest versions of Red Hat Enterprise Virtualization or Red Hat KVM that contain the security patch.
Who is affected by CVE-2010-0431?
CVE-2010-0431 affects users of Red Hat Enterprise Virtualization 2.2 and Red Hat KVM version 83.
What type of attack does CVE-2010-0431 enable?
CVE-2010-0431 enables a malicious guest user to perform unauthorized memory access on the hosting QEMU process.
Is there a workaround for CVE-2010-0431?
There are no specific workarounds for CVE-2010-0431; applying the relevant security updates is the recommended action.