CVE-2015-5154
published 2015-08-12CVE-2015-5154: Heap-based buffer overflow in the IDE subsystem in QEMU, as used in Xen 4.5.x and earlier, when the container has a CDROM drive enabled, allows local guest…
PriorityP434high7.2CVSS 2.0
AVLACLAuNCCICAC
EPSS
0.63%
46.2th percentile
Heap-based buffer overflow in the IDE subsystem in QEMU, as used in Xen 4.5.x and earlier, when the container has a CDROM drive enabled, allows local guest users to execute arbitrary code on the host via unspecified ATAPI commands.
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | qemu | < qemu 1:2.4+dfsg-1a (bookworm) | qemu 1:2.4+dfsg-1a (bookworm) |
| debian | xen | < qemu 1:2.4+dfsg-1a (bookworm) | qemu 1:2.4+dfsg-1a (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| qemu | qemu | <= 2.3.0 | — |
| qemu | qemu | >= 0 < 1:2.4+dfsg-1a | 1:2.4+dfsg-1a |
| qemu | qemu | >= 0 < 1:2.4+dfsg-1a | 1:2.4+dfsg-1a |
| qemu | qemu | >= 0 < 1:2.4+dfsg-1a | 1:2.4+dfsg-1a |
| qemu | qemu | >= 0 < 1:2.4+dfsg-1a | 1:2.4+dfsg-1a |
| qemu | qemu | >= 0 < 2.0.0+dfsg-2ubuntu1.15 | 2.0.0+dfsg-2ubuntu1.15 |
| suse | linux_enterprise_debuginfo | — | — |
| suse | linux_enterprise_desktop | — | — |
| suse | linux_enterprise_desktop | — | — |
| suse | linux_enterprise_server | — | — |
| suse | linux_enterprise_software_development_kit | — | — |
| suse | linux_enterprise_software_development_kit | — | — |
| suse | suse_linux_enterprise_server | — | — |
| xen | xen | <= 4.5.0 | — |
| xen | xen | — | — |
| xen | xen | >= 0 < 4.4.0-1 | 4.4.0-1 |
| xen | xen | >= 0 < 4.4.0-1 | 4.4.0-1 |
| xen | xen | >= 0 < 4.4.0-1 | 4.4.0-1 |
| xen | xen | >= 0 < 4.4.0-1 | 4.4.0-1 |
CVSS provenance
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
osv7.2HIGH
vendor_debian7.2HIGH
vendor_redhat7.2HIGH
vendor_ubuntu6.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
QEMU vulnerabilities
vendor_ubuntu·2015-07-28·CVSS 6.9
CVE-2015-3214 [MEDIUM] QEMU vulnerabilities
Title: QEMU vulnerabilities
Summary: Several security issues were fixed in QEMU.
Matt Tait discovered that QEMU incorrectly handled PIT emulation. In a
non-default configuration, a malicious guest could use this issue to cause
a denial of service, or possibly execute arbitrary code on the host as the
user running the QEMU process. In the default installation, when QEMU is
used with libvirt, attackers would be isolated by the libvirt AppArmor
profile. (CVE-2015-3214)
Kevin Wolf discovered that QEMU incorrectly handled processing ATAPI
commands. A malicious guest could use this issue to cause a denial of
service, or possibly execute arbitrary code on the host as the user running
the QEMU process. In the default installation, when QEMU is used with
libvirt, attackers would be isolated by t
Red Hat
qemu: ide: atapi: heap overflow during I/O buffer memory access
vendor_redhat·2015-07-27·CVSS 7.2
CVE-2015-5154 [HIGH] CWE-119 qemu: ide: atapi: heap overflow during I/O buffer memory access
qemu: ide: atapi: heap overflow during I/O buffer memory access
Heap-based buffer overflow in the IDE subsystem in QEMU, as used in Xen 4.5.x and earlier, when the container has a CDROM drive enabled, allows local guest users to execute arbitrary code on the host via unspecified ATAPI commands.
A heap buffer overflow flaw was found in the way QEMU's IDE subsystem handled I/O buffer access while processing certain ATAPI commands. A privileged guest user in a guest with the CDROM drive enabled could potentially use this flaw to execute arbitrary code on the host with the privileges of the host's QEMU process corresponding to the guest.
Statement: This issue does not affect the versions of the kvm and xen packages as shipped with Red Hat Enterprise Linux 5, the versions of the qemu-kvm pac
Debian
CVE-2015-5154: qemu - Heap-based buffer overflow in the IDE subsystem in QEMU, as used in Xen 4.5.x an...
vendor_debian·2015·CVSS 7.2
CVE-2015-5154 [HIGH] CVE-2015-5154: qemu - Heap-based buffer overflow in the IDE subsystem in QEMU, as used in Xen 4.5.x an...
Heap-based buffer overflow in the IDE subsystem in QEMU, as used in Xen 4.5.x and earlier, when the container has a CDROM drive enabled, allows local guest users to execute arbitrary code on the host via unspecified ATAPI commands.
Scope: local
bookworm: resolved (fixed in 1:2.4+dfsg-1a)
bullseye: resolved (fixed in 1:2.4+dfsg-1a)
forky: resolved (fixed in 1:2.4+dfsg-1a)
sid: resolved (fixed in 1:2.4+dfsg-1a)
trixie: resolved (fixed in 1:2.4+dfsg-1a)
GHSA
GHSA-j9wc-jv66-352g: Heap-based buffer overflow in the IDE subsystem in QEMU, as used in Xen 4
ghsa_unreviewed·2022-05-14
CVE-2015-5154 [HIGH] CWE-119 GHSA-j9wc-jv66-352g: Heap-based buffer overflow in the IDE subsystem in QEMU, as used in Xen 4
Heap-based buffer overflow in the IDE subsystem in QEMU, as used in Xen 4.5.x and earlier, when the container has a CDROM drive enabled, allows local guest users to execute arbitrary code on the host via unspecified ATAPI commands.
OSV
CVE-2015-5154: Heap-based buffer overflow in the IDE subsystem in QEMU, as used in Xen 4
osv·2015-08-12·CVSS 7.2
CVE-2015-5154 [HIGH] CVE-2015-5154: Heap-based buffer overflow in the IDE subsystem in QEMU, as used in Xen 4
Heap-based buffer overflow in the IDE subsystem in QEMU, as used in Xen 4.5.x and earlier, when the container has a CDROM drive enabled, allows local guest users to execute arbitrary code on the host via unspecified ATAPI commands.
OSV
qemu vulnerabilities
osv·2015-07-28·CVSS 6.9
CVE-2015-3214 [MEDIUM] qemu vulnerabilities
qemu vulnerabilities
Matt Tait discovered that QEMU incorrectly handled PIT emulation. In a
non-default configuration, a malicious guest could use this issue to cause
a denial of service, or possibly execute arbitrary code on the host as the
user running the QEMU process. In the default installation, when QEMU is
used with libvirt, attackers would be isolated by the libvirt AppArmor
profile. (CVE-2015-3214)
Kevin Wolf discovered that QEMU incorrectly handled processing ATAPI
commands. A malicious guest could use this issue to cause a denial of
service, or possibly execute arbitrary code on the host as the user running
the QEMU process. In the default installation, when QEMU is used with
libvirt, attackers would be isolated by the libvirt AppArmor profile.
(CVE-2015-5154)
Zhu Donghai dis
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2015-5154 xen: qemu: ide: atapi: heap overflow during I/O buffer memory access [fedora-all]
bugzilla·2015-07-27·CVSS 7.2
CVE-2015-5154 [HIGH] CVE-2015-5154 xen: qemu: ide: atapi: heap overflow during I/O buffer memory access [fedora-all]
CVE-2015-5154 xen: qemu: ide: atapi: heap overflow during I/O buffer memory access [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supp
Bugzilla
CVE-2015-5154 qemu: ide: atapi: heap overflow during I/O buffer memory access [fedora-all]
bugzilla·2015-07-27·CVSS 7.2
CVE-2015-5154 [HIGH] CVE-2015-5154 qemu: ide: atapi: heap overflow during I/O buffer memory access [fedora-all]
CVE-2015-5154 qemu: ide: atapi: heap overflow during I/O buffer memory access [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported
Bugzilla
CVE-2015-5154 qemu: ide: atapi: heap overflow during I/O buffer memory access [epel-7]
bugzilla·2015-07-27·CVSS 7.2
CVE-2015-5154 [HIGH] CVE-2015-5154 qemu: ide: atapi: heap overflow during I/O buffer memory access [epel-7]
CVE-2015-5154 qemu: ide: atapi: heap overflow during I/O buffer memory access [epel-7]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora EPEL.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
epel-7 tracking bug for qemu: see blocks b
Bugzilla
CVE-2015-5154 qemu: ide: atapi: heap overflow during I/O buffer memory access
bugzilla·2015-07-15·CVSS 7.2
CVE-2015-5154 [HIGH] CVE-2015-5154 qemu: ide: atapi: heap overflow during I/O buffer memory access
CVE-2015-5154 qemu: ide: atapi: heap overflow during I/O buffer memory access
A heap overflow flaw was found in the way QEMU's IDE subsystem
handled I/O buffer access while processing certain ATAPI commands.
A privileged guest user in a guest with CDROM drive enabled could
potentially use this flaw to execute arbitrary code on the host
with the privileges of the host's QEMU process corresponding to
the guest.
Upstream fix:
-> git.qemu.org/?p=qemu.git;a=commit;h=d2ff85854512574e7209f295e87b0835d5b032c6
Acknowledgements:
This issue was discovered by Kevin Wolf of Red Hat.
Discussion:
Statement:
This issue does not affect the versions of the kvm and xen packages as shipped with Red Hat Enterprise Linux 5, the versions of the qemu-kvm packages as shipped with Red Hat Enterprise Linux 6
http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163472.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-August/163658.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-August/163681.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00041.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00042.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-08/msg00017.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-08/msg00018.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-08/msg00020.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-08/msg00022.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-09/msg00027.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-10/msg00019.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1507.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1508.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1512.htmlhttp://support.citrix.com/article/CTX201593http://www.debian.org/security/2015/dsa-3348http://www.securityfocus.com/bid/76048http://www.securitytracker.com/id/1033074http://xenbits.xen.org/xsa/advisory-138.htmlhttps://security.gentoo.org/glsa/201510-02https://security.gentoo.org/glsa/201604-03http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163472.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-August/163658.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-August/163681.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00041.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00042.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-08/msg00017.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-08/msg00018.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-08/msg00020.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-08/msg00022.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-09/msg00027.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-10/msg00019.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1507.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1508.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1512.htmlhttp://support.citrix.com/article/CTX201593http://www.debian.org/security/2015/dsa-3348http://www.securityfocus.com/bid/76048http://www.securitytracker.com/id/1033074http://xenbits.xen.org/xsa/advisory-138.htmlhttps://security.gentoo.org/glsa/201510-02https://security.gentoo.org/glsa/201604-03
2015-08-12
Published