CVE-2011-2527

Name of the Vulnerable Software and Affected Versions Qemu versions 0.14.0 and earlier

Description The issue arises from the change process uid function in os-posix.c, which fails to properly drop group privileges when the -runas option is used. This allows local guest users to access restricted files on the host.

Recommendations For Qemu versions 0.14.0 and earlier, consider restricting access to sensitive files on the host until a fixed version is available. As a temporary workaround, avoid using the -runas option to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.