CVE-2008-0928
Fixed in a distro release EPSS <1%
Qemu 0.9.1 and earlier does not perform range checks for block device read or write requests, which allows guest host users with root privileges to access arbitrary memory and escape the virtual machine.
Products: qemu
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | qemu | 0.9.1+svn20081207-1 |
| Debian 13 | qemu | 0.9.1+svn20081207-1 |
| Debian 14 | qemu | 0.9.1+svn20081207-1 |
| Debian 4.0 | qemu | 0.8.2-4etch3 |
| Debian 5.0 | kvm | 60+dfsg-1+lenny1 |
| Debian 5.0 | qemu | 0.9.1-10lenny1 |
| Red Hat Enterprise Linux 5 | xen | 0:3.0.3-41.el5_1.5 |
| Red Hat Enterprise Linux 5 | xen-debuginfo | 0:3.0.3-41.el5_1.5 |
| Red Hat Enterprise Linux 5 | xen-libs | 0:3.0.3-41.el5_1.5 |
| Red Hat rhel virtualization 5 | xen | 0:3.0.3-41.el5_1.5 |
| Red Hat rhel virtualization 5 | xen-debuginfo | 0:3.0.3-41.el5_1.5 |
| Red Hat rhel virtualization 5 | xen-devel | 0:3.0.3-41.el5_1.5 |
| openSUSE Tumbleweed | qemu | 2.6.1-1.5 |
| openSUSE Tumbleweed | qemu-linux-user | 2.6.1-1.5 |