Vulnerability Name:

CVE-2010-0431 (CCN-61266)

Assigned:2010-08-19
Published:2010-08-19
Updated:2010-08-25
Summary:QEMU-KVM, as used in the Hypervisor (aka rhev-hypervisor) in Red Hat Enterprise Virtualization (RHEV) 2.2 and KVM 83, does not properly validate guest QXL driver pointers, which allows guest OS users to cause a denial of service (invalid pointer dereference and guest OS crash) or possibly gain privileges via unspecified vectors.
CVSS v3 Severity:7.5 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): High
Privileges Required (PR): Low
User Interaction (UI): Required
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:6.6 Medium (CVSS v2 Vector: AV:L/AC:M/Au:S/C:C/I:C/A:C)
4.9 Medium (Temporal CVSS v2 Vector: AV:L/AC:M/Au:S/C:C/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Medium
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
6.6 Medium (CCN CVSS v2 Vector: AV:L/AC:M/Au:S/C:C/I:C/A:C)
4.9 Medium (CCN Temporal CVSS v2 Vector: AV:L/AC:M/Au:S/C:C/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Medium
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
6.6 Medium (REDHAT CVSS v2 Vector: AV:L/AC:M/Au:S/C:C/I:C/A:C)
4.9 Medium (REDHAT Temporal CVSS v2 Vector: AV:L/AC:M/Au:S/C:C/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Medium
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-20
Vulnerability Consequences:Gain Privileges
References:Source: CCN
Type: QEMU Web page
QEMU

Source: MITRE
Type: CNA
CVE-2010-0431

Source: CCN
Type: RHSA-2010-0622
Important: rhev-hypervisor security and bug fix update

Source: CCN
Type: RHSA-2010-0627
Important: kvm security and bug fix update

Source: CCN
Type: OSVDB ID: 67475
QEMU-KVM Hypervisor Guest QXL Driver Pointer Validation Weakness Guest OS DoS

Source: CCN
Type: BID-42578
QEMU QXL Graphics Local Memory Corruption Vulnerability

Source: CCN
Type: Red Hat Bugzilla Bug 568809
CVE-2010-0431 qemu: Insufficient guest provided pointers validation

Source: CONFIRM
Type: Patch, Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=568809

Source: XF
Type: UNKNOWN
qemu-qxl-privilege-escalation(61266)

Source: REDHAT
Type: Vendor Advisory
RHSA-2010:0622

Source: REDHAT
Type: Patch, Vendor Advisory
RHSA-2010:0627

Vulnerable Configuration:Configuration 1:
  • cpe:/a:redhat:enterprise_virtualization:2.2:*:*:*:*:*:*:*
  • OR cpe:/a:redhat:kvm:83:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/a:redhat:rhel_virtualization:5:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/a:redhat:rhel_virtualization:5::client:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/a:redhat:rhel_virtualization:5::server:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:fabrice_bellard:qemu:0.8.2:*:*:*:*:*:*:*
  • AND
  • cpe:/a:redhat:rhel_virtualization:5:*:server:*:*:*:*:*
  • OR cpe:/a:redhat:enterprise_virtualization:2.2:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.mitre.oval:def:23083
    P
    		ELSA-2010:0627: kvm security and bug fix update (Important)
    2014-05-26
    oval:org.mitre.oval:def:21834
    P
    		RHSA-2010:0627: kvm security and bug fix update (Important)
    2014-02-24
    oval:com.redhat.rhsa:def:20100627
    P
    		RHSA-2010:0627: kvm security and bug fix update (Important)
    2010-08-19
    BACK
    redhat enterprise virtualization 2.2
    redhat kvm 83
    fabrice_bellard qemu 0.8.2
    redhat rhel virtualization 5
    redhat enterprise virtualization 2.2