CVE-2014-3615: Infoleak
An information leakage flaw was found in Qemu's VGA emulator. It could lead to leaking host memory bytes to a VNC client. It could occur when a guest GOP driver attempts to set a high display resolution.
A privileged user/program able to set such high resolution could use this flaw to leak host memory bytes.
Upstream fixes: --------------- -> http://git.qemu.org/?p=qemu.git;a=commit;h=c1b886c45dc70f247300f549dce9833f3fa2def5 -> http://git.qemu.org/?p=qemu.git;a=commit;h=ab9509cceabef28071e41bdfa073083859c949a7
Other sources
The VGA emulator in QEMU allows local guest users to read host memory by setting the display to a high resolution.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3615?
CVE-2014-3615 has been classified as a medium severity vulnerability due to the potential for information leakage.
How do I fix CVE-2014-3615?
To fix CVE-2014-3615, you should upgrade Qemu to the latest version that addresses this vulnerability.
What types of systems are affected by CVE-2014-3615?
CVE-2014-3615 affects various versions of Qemu and operating systems including Red Hat Enterprise Linux, Ubuntu, and Debian.
What is the exploit type for CVE-2014-3615?
CVE-2014-3615 involves an information leakage flaw that may expose host memory to a VNC client.
Is exploitation of CVE-2014-3615 remote or local?
Exploitation of CVE-2014-3615 can occur remotely if a privileged user or program sets a high display resolution.