CVE-2019-13164: High severity Qemu Qemu vulnerability
It was discovered that the Access Control List (ACL) implemented by qemu-bridge-helper program could be bypassed in particular cases when the bridge interface names are as long as IFNAMSIZ-1, ie 15 characters. If the ACL specified in the /etc/qemu-kvm/bridge.conf file denies access to a bridge interface with a name long IFNAMSIZ-1, but it allows all other interfaces, it is possible for a local attacker to use qemu-bridge-helper to create a tap device and attach it to a denied bridge interface, thus bypassing the ACL. This could be used by the attacker to get access to confidential data transmitted on the bridge.
Upstream patch: --------------- -> https://lists.gnu.org/archive/html/qemu-devel/2019-07/msg00245.html
Reference: ---------- -> https://www.openwall.com/lists/oss-security/2019/07/02/2
Other sources
qemu-bridge-helper.c in QEMU 3.1 and 4.0.0 does not ensure that a network interface name (obtained from bridge.conf or a --br=bridge option) is limited to the IFNAMSIZ size, which can lead to an ACL bypass.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2019-13164?
CVE-2019-13164 is a vulnerability in QEMU that allows an ACL bypass.
What is the severity of CVE-2019-13164?
The severity of CVE-2019-13164 is high (severity value: 7).
How does CVE-2019-13164 affect QEMU?
CVE-2019-13164 affects QEMU versions 3.1 and 4.0.0.
How can I fix CVE-2019-13164?
To fix CVE-2019-13164, update QEMU to version 3.1+dfsg-8+deb10u2 or 4.1-1.
Where can I find more information about CVE-2019-13164?
You can find more information about CVE-2019-13164 at the following references: [1](https://lists.gnu.org/archive/html/qemu-devel/2019-07/msg00245.html), [2](https://security-tracker.debian.org/tracker/CVE-2019-12164), [3](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12164).