CVE-2008-0928
published 2008-03-03CVE-2008-0928: Qemu 0.9.1 and earlier does not perform range checks for block device read or write requests, which allows guest host users with root privileges to access…
PriorityP423medium4.7CVSS 2.0
AVLACMAuNCCINAN
EPSS
0.37%
29.4th percentile
Qemu 0.9.1 and earlier does not perform range checks for block device read or write requests, which allows guest host users with root privileges to access arbitrary memory and escape the virtual machine.
Affected
34 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | qemu | < qemu 0.9.1+svn20081207-1 (bookworm) | qemu 0.9.1+svn20081207-1 (bookworm) |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
CVSS provenance
nvdv2.04.7MEDIUMAV:L/AC:M/Au:N/C:C/I:N/A:N
osv4.7MEDIUM
vendor_debian4.7LOW
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-4gr3-prqp-v6r3: Qemu 0
ghsa_unreviewed·2022-05-01
CVE-2008-0928 [MEDIUM] GHSA-4gr3-prqp-v6r3: Qemu 0
Qemu 0.9.1 and earlier does not perform range checks for block device read or write requests, which allows guest host users with root privileges to access arbitrary memory and escape the virtual machine.
OSV
CVE-2008-0928: Qemu 0
osv·2008-03-03·CVSS 4.7
CVE-2008-0928 [MEDIUM] CVE-2008-0928: Qemu 0
Qemu 0.9.1 and earlier does not perform range checks for block device read or write requests, which allows guest host users with root privileges to access arbitrary memory and escape the virtual machine.
Red Hat
Qemu insufficient block device address range checking
vendor_redhat·2008-02-19·CVSS 4.7
CVE-2008-0928 [MEDIUM] Qemu insufficient block device address range checking
Qemu insufficient block device address range checking
Qemu 0.9.1 and earlier does not perform range checks for block device read or write requests, which allows guest host users with root privileges to access arbitrary memory and escape the virtual machine.
Debian
CVE-2008-0928: qemu - Qemu 0.9.1 and earlier does not perform range checks for block device read or wr...
vendor_debian·2008·CVSS 4.7
CVE-2008-0928 [MEDIUM] CVE-2008-0928: qemu - Qemu 0.9.1 and earlier does not perform range checks for block device read or wr...
Qemu 0.9.1 and earlier does not perform range checks for block device read or write requests, which allows guest host users with root privileges to access arbitrary memory and escape the virtual machine.
Scope: local
bookworm: resolved (fixed in 0.9.1+svn20081207-1)
bullseye: resolved (fixed in 0.9.1+svn20081207-1)
forky: resolved (fixed in 0.9.1+svn20081207-1)
sid: resolved (fixed in 0.9.1+svn20081207-1)
trixie: resolved (fixed in 0.9.1+svn20081207-1)
No detection rules found.
http://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.htmlhttp://marc.info/?l=debian-security&m=120343592917055&w=2http://secunia.com/advisories/29081http://secunia.com/advisories/29129http://secunia.com/advisories/29136http://secunia.com/advisories/29172http://secunia.com/advisories/29963http://secunia.com/advisories/34642http://secunia.com/advisories/35031http://www.debian.org/security/2009/dsa-1799http://www.mandriva.com/security/advisories?name=MDVSA-2008:162http://www.mandriva.com/security/advisories?name=MDVSA-2009:016http://www.redhat.com/archives/fedora-package-announce/2008-February/msg00830.htmlhttp://www.redhat.com/archives/fedora-package-announce/2008-February/msg00850.htmlhttp://www.redhat.com/support/errata/RHSA-2008-0194.htmlhttp://www.securityfocus.com/bid/28001https://bugzilla.redhat.com/show_bug.cgi?id=433560https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9706https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00852.htmlhttps://www.redhat.com/archives/fedora-package-announce/2008-February/msg00857.htmlhttps://www.redhat.com/archives/fedora-package-announce/2008-February/msg00900.htmlhttps://www.redhat.com/archives/fedora-package-announce/2008-February/msg00957.htmlhttp://lists.opensuse.org/opensuse-security-announce/2009-04/msg00003.htmlhttp://marc.info/?l=debian-security&m=120343592917055&w=2http://secunia.com/advisories/29081http://secunia.com/advisories/29129http://secunia.com/advisories/29136http://secunia.com/advisories/29172http://secunia.com/advisories/29963http://secunia.com/advisories/34642http://secunia.com/advisories/35031http://www.debian.org/security/2009/dsa-1799http://www.mandriva.com/security/advisories?name=MDVSA-2008:162http://www.mandriva.com/security/advisories?name=MDVSA-2009:016http://www.redhat.com/archives/fedora-package-announce/2008-February/msg00830.htmlhttp://www.redhat.com/archives/fedora-package-announce/2008-February/msg00850.htmlhttp://www.redhat.com/support/errata/RHSA-2008-0194.htmlhttp://www.securityfocus.com/bid/28001https://bugzilla.redhat.com/show_bug.cgi?id=433560https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9706https://www.redhat.com/archives/fedora-package-announce/2008-February/msg00852.htmlhttps://www.redhat.com/archives/fedora-package-announce/2008-February/msg00857.htmlhttps://www.redhat.com/archives/fedora-package-announce/2008-February/msg00900.htmlhttps://www.redhat.com/archives/fedora-package-announce/2008-February/msg00957.html
2008-03-03
Published