CVE-2019-8934
Fixed in a distro release EPSS <1%
hw/ppc/spapr.c in QEMU through 3.1.0 allows Information Exposure because the hypervisor shares the /proc/device-tree/system-id and /proc/device-tree/model system attributes with a guest.
Products: qemu, opensuse leap
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | qemu | 1:4.1-1 |
| Debian 13 | qemu | 1:4.1-1 |
| Debian 14 | qemu | 1:4.1-1 |
| SUSE Linux Enterprise Desktop 12 SP4 | qemu | 2.11.2-5.13.1 |
| SUSE Linux Enterprise Module for Basesystem 15 | qemu | 2.11.2-9.25.1 |
| SUSE Linux Enterprise Module for Server Applications 15 | qemu | 2.11.2-9.25.1 |
| SUSE Linux Enterprise Server 12 SP2-BCL | qemu | 2.6.2-41.65.1 |
| SUSE Linux Enterprise Server 12 SP4 | qemu | 2.11.2-5.13.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | qemu | 2.11.2-5.13.1 |
| Ubuntu Pro 14.04 LTS | qemu | no fix |
| Ubuntu Pro 16.04 LTS | qemu | no fix |
| Ubuntu Pro 18.04 LTS | qemu | no fix |
| openSUSE Leap 15.0 | qemu | 2.11.2-lp150.7.22.1 |
| openSUSE Tumbleweed | qemu | 6.1.0-32.1 |