CVE-2012-3515 — Improper Input Validation in Qemu

CWE-20 — Improper Input ValidationCWE-839 — Numeric Range Comparison Without Minimum CheckCWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer10 documents8 sources
Severity
7.2HIGHNVD
EPSS
0.1%
top 68.67%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
13
QemuXENCanonical Ubuntu Linux+10 more
Timeline
PublishedNov 23
Latest updateMay 13

Description

Qemu, as used in Xen 4.0, 4.1 and possibly other products, when emulating certain devices with a virtual console backend, allows local OS guest users to gain privileges via a crafted escape VT100 sequence that triggers the overwrite of a "device model's address space."

CVSS vector

AV:L/AC:L/C:C/I:C/A:CExploitability: 3.9 | Impact: 10.0

Affected Packages12 packages

▶NVDqemu/qemu< 1.2.0
▶Debianqemu/qemu< 1.1.2+dfsg-1+3
▶NVDredhat/virtualization3.0, 5.0, 6.0+2
▶Debianxen/xen< 4.1.3-2+3
▶NVDxen/xen4.0.0, 4.1.0+1

Also affects: Debian Linux 6.0, 7.0, Ubuntu Linux 10.04, 11.04, 11.10, 12.04, Enterprise Linux 6.3

🔴Vulnerability Details

3
GHSA
GHSA-rwhm-5hjg-54j9: Qemu, as used in Xen 4↗2022-05-13
▶
OSV
CVE-2012-3515: Qemu, as used in Xen 4↗2012-11-23
▶
CVEList
CVE-2012-3515: Qemu, as used in Xen 4↗2012-11-23
▶

📋Vendor Advisories

3
Ubuntu
QEMU vulnerability↗2012-10-02
▶
Red Hat
qemu: VT100 emulation vulnerability↗2012-09-05
▶
Debian
CVE-2012-3515: qemu - Qemu, as used in Xen 4.0, 4.1 and possibly other products, when emulating certai...↗2012
▶

💬Community

3
Bugzilla
CVE-2012-3515 qemu: VT100 emulation vulnerability [fedora-all]↗2012-09-05
▶
Bugzilla
CVE-2012-3515 qemu: VT100 emulation vulnerability [fedora-all]↗2012-09-05
▶
Bugzilla
CVE-2012-3515 qemu: VT100 emulation vulnerability↗2012-08-23
▶
CVE-2012-3515 — Improper Input Validation in Qemu | cvebase