Improper access control in QEMU - CVE-2019-13164
Published: July 9, 2019 / Updated: April 28, 2020
Vulnerability identifier: #VU19054
CSH Severity: Low
CVSS v4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-13164
CWE-ID: CWE-284
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local attacker to gain unauthorized access to sensitive information.
The vulnerability exists due to qemu-bridge-helper.c does not ensure that a network interface name (obtained from bridge.conf or a --br=bridge option) is limited to the IFNAMSIZ size. A local attacker can create a tap device and attach it to a denied bridge interface, bypass the Access Control List (ACL) and get access to confidential data transmitted on the bridge.
Affected software
QEMU
Gentoo Linux
Opensuse
qemu (Ubuntu package)
qemu (Debian package)
Gentoo Linux
Opensuse
qemu (Ubuntu package)
qemu (Debian package)
How to mitigate CVE-2019-13164
Install update from vendor's website.
QEMU - update to 4.0.1
qemu (Ubuntu package) - addressed in versions 1:2.5+dfsg-5ubuntu10.42, 1:2.11+dfsg-1ubuntu7.20, 1:3.1+dfsg-2ubuntu3.6, 1:4.0+dfsg-0ubuntu9.1
qemu (Debian package) - addressed in versions 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8+deb10u2
qemu (Ubuntu package) - addressed in versions 1:2.5+dfsg-5ubuntu10.42, 1:2.11+dfsg-1ubuntu7.20, 1:3.1+dfsg-2ubuntu3.6, 1:4.0+dfsg-0ubuntu9.1
qemu (Debian package) - addressed in versions 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8+deb10u2