Vulnerability Name:

CVE-2010-0429 (CCN-61263)

Assigned:2010-08-19
Published:2010-08-19
Updated:2010-08-25
Summary:libspice, as used in QEMU-KVM in the Hypervisor (aka rhev-hypervisor) in Red Hat Enterprise Virtualization (RHEV) 2.2 and qspice 0.3.0, does not properly restrict the addresses upon which memory-management actions are performed, which allows guest OS users to cause a denial of service (guest OS crash) or possibly gain privileges via unspecified vectors.
CVSS v3 Severity:7.5 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): High
Privileges Required (PR): Low
User Interaction (UI): Required
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:6.6 Medium (CVSS v2 Vector: AV:L/AC:M/Au:S/C:C/I:C/A:C)
4.9 Medium (Temporal CVSS v2 Vector: AV:L/AC:M/Au:S/C:C/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Medium
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
6.6 Medium (CCN CVSS v2 Vector: AV:L/AC:M/Au:S/C:C/I:C/A:C)
4.9 Medium (CCN Temporal CVSS v2 Vector: AV:L/AC:M/Au:S/C:C/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Medium
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
6.6 Medium (REDHAT CVSS v2 Vector: AV:L/AC:M/Au:S/C:C/I:C/A:C)
4.9 Medium (REDHAT Temporal CVSS v2 Vector: AV:L/AC:M/Au:S/C:C/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Medium
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-264
Vulnerability Consequences:Gain Privileges
References:Source: CCN
Type: QEMU Web page
QEMU

Source: MITRE
Type: CNA
CVE-2010-0429

Source: CCN
Type: RHSA-2010-0622
Important: rhev-hypervisor security and bug fix update

Source: CCN
Type: RHSA-2010-0633
Important: qspice security update

Source: CCN
Type: OSVDB ID: 67476
QEMU-KVM Hypervisor libspice Memory Management Address Restriction Bypass Guest OS DoS

Source: CCN
Type: BID-42583
QEMU KVM 'libspice' Component CVE-2010-0429 Local Privilege Escalation Vulnerability

Source: CCN
Type: Red Hat Bugzilla Bug 568701
CVE-2010-0429 libspice: Relying on guest provided data structures to indicate memory allocation

Source: CONFIRM
Type: UNKNOWN
https://bugzilla.redhat.com/show_bug.cgi?id=568701

Source: XF
Type: UNKNOWN
qemu-libspice-privilege-escalation(61263)

Source: REDHAT
Type: Patch, Vendor Advisory
RHSA-2010:0622

Source: REDHAT
Type: Patch, Vendor Advisory
RHSA-2010:0633

Vulnerable Configuration:Configuration 1:
  • cpe:/a:redhat:enterprise_virtualization:2.2:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:qspice:0.3.0:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/a:redhat:rhel_virtualization:5:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/a:redhat:rhel_virtualization:5::client:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/a:redhat:rhel_virtualization:5::server:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:fabrice_bellard:qemu:0.8.2:*:*:*:*:*:*:*
  • AND
  • cpe:/a:redhat:rhel_virtualization:5:*:server:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:5:*:client:*:*:*:*:*
  • OR cpe:/a:redhat:enterprise_virtualization:2.2:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:22924
    P
    		ELSA-2010:0633: qspice security update (Important)
    2014-05-26
    oval:org.mitre.oval:def:22045
    P
    		RHSA-2010:0633: qspice security update (Important)
    2014-02-24
    oval:com.redhat.rhsa:def:20100633
    P
    		RHSA-2010:0633: qspice security update (Important)
    2010-08-19
    BACK
    redhat enterprise virtualization 2.2
    redhat qspice 0.3.0
    fabrice_bellard qemu 0.8.2
    redhat rhel virtualization 5
    redhat enterprise linux 5
    redhat enterprise virtualization 2.2