CVE-2008-2004
Fixed in a distro release EPSS <1%
The drive_init function in QEMU 0.9.1 determines the format of a raw disk image based on the header, which allows local guest users to read arbitrary files on the host by modifying the header to identify a different format, which is used when the guest is restarted.
Products: qemu
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | qemu | 0.9.1-5 |
| Debian 13 | qemu | 0.9.1-5 |
| Debian 14 | qemu | 0.9.1-5 |
| Debian 5.0 | kvm | 60+dfsg-1+lenny1 |
| Red Hat Enterprise Linux 5 | xen | 0:3.0.3-41.el5_1.5 |
| Red Hat Enterprise Linux 5 | xen-debuginfo | 0:3.0.3-41.el5_1.5 |
| Red Hat Enterprise Linux 5 | xen-libs | 0:3.0.3-41.el5_1.5 |
| Red Hat rhel virtualization 5 | xen | 0:3.0.3-41.el5_1.5 |
| Red Hat rhel virtualization 5 | xen-debuginfo | 0:3.0.3-41.el5_1.5 |
| Red Hat rhel virtualization 5 | xen-devel | 0:3.0.3-41.el5_1.5 |