Memory leak in QEMU - CVE-2019-9824

Vulnerability identifier: #VU18303

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-9824

CWE-ID: CWE-401

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to gain access to sensitive information on the system.

The vulnerability exists due memory leak within the SLiRP networking implementation. A local user can read uninitialised stack memory contents.

QEMU
Red Hat Virtualization Manager
Amazon Linux AMI
Gentoo Linux
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for x86_64
Opensuse
Fedora
Red Hat Virtualization for IBM Power LE
Red Hat Virtualization
Red Hat OpenStack
Red Hat OpenStack for IBM Power
qemu-kvm-rhev (Red Hat package)
qemu

Install updates from vendor's website.

qemu-kvm-rhev (Red Hat package) - update to 2.12.0-33.el7
qemu - update to 3.1.0-9.fc30

• https://lists.opensuse.org/opensuse-security-announce/2019-04/msg00072.html

• OpenSUSE Linux update for xen
• OpenSUSE Linux update for qemu
• Red Hat update for qemu-kvm
• Red Hat update for qemu-kvm
• Red Hat update for qemu-kvm-rhev
• Gentoo update for QEMU
• Red Hat update for virt:rhel
• Amazon Linux AMI update for qemu-kvm
• Amazon Linux AMI update for qemu-kvm
• OpenSUSE Linux update for qemu
• Red Hat Virtualization 4 for Red Hat Enterprise Linux 7 and Red Hat Virtualization Engine 4.3 update for qemu-kvm-rhev
• Fedora 30 update for qemu