CVE-2011-3346: Buffer Overflow
Buffer overflow in hw/scsi-disk.c in the SCSI subsystem in QEMU before 0.15.2, as used by Xen, might allow local guest users with permission to access the CD-ROM to cause a denial of service (guest crash) via a crafted SAI READ CAPACITY SCSI command. NOTE: this is only a vulnerability when root has manually modified certain permissions or ACLs.
Other sources
Paolo Bonzini found a buffer overflow in QEMU's SCSI subsystem. hw/scsi-disk.c tries to zero a user-provided number of bytes in a fixed-size buffer. An unprivileged local guest user can potentially use this flaw to crash the guest.
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2011-3346?
CVE-2011-3346 is considered a moderate severity vulnerability due to its potential to cause denial of service.
How do I fix CVE-2011-3346?
To fix CVE-2011-3346, upgrade to QEMU version 0.15.2 or later.
Who is affected by CVE-2011-3346?
CVE-2011-3346 affects local guest users with permission to access the CD-ROM in QEMU versions prior to 0.15.2.
What impact does CVE-2011-3346 have?
The impact of CVE-2011-3346 is a potential guest crash resulting from a crafted SAI READ CAPACITY SCSI command.
Is CVE-2011-3346 exploitable remotely?
No, CVE-2011-3346 is not remotely exploitable; it requires local access to the guest environment.