CVE-2013-4535: Input Validation
Both virtio-block and virtio-serial read, VirtQueueElements are read in as buffers, and passed to virtqueuemapsg(), where numsg is taken from the wire and can force writes to indicies beyond VIRTQUEUEMAXSIZE.
An user able to alter the savevm data (either on the disk or over the wire during migration) could use this flaw to to corrupt QEMU process memory on the (destination) host, which could potentially result in arbitrary code execution on the host with the privileges of the QEMU process.
Upstream fix: ------------- -> http://git.qemu.org/?p=qemu.git;a=commit;h=36cf2a37132c7f01fa9adb5f95f5312b27742fd4
Other sources
The virtqueuemapsg function in hw/virtio/virtio.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary files via a crafted savevm image, related to virtio-block or virtio-serial read.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2013-4535?
CVE-2013-4535 has a high severity level, potentially allowing for memory corruption due to out-of-bounds writes.
How do I fix CVE-2013-4535?
To fix CVE-2013-4535, upgrade to QEMU version 1.5.3 or later, ensuring the system is using compatible software versions.
Which software is affected by CVE-2013-4535?
CVE-2013-4535 affects QEMU KVM versions up to 1.7.2, as well as specific versions of Red Hat Enterprise Virtualization and Red Hat Enterprise Linux.
Can CVE-2013-4535 lead to system exploits?
Yes, CVE-2013-4535 can potentially be exploited to execute arbitrary code through specially crafted input.
Is there a patch available for CVE-2013-4535?
Yes, patches addressing CVE-2013-4535 have been included in subsequent updates of affected packages.