CVE-2019-8934

Name of the Vulnerable Software and Affected Versions QEMU versions prior to 3.1.0

Description The issue is related to information exposure due to the hypervisor sharing system attributes with a guest, specifically the /proc/device-tree/system-id and /proc/device-tree/model. This is caused by insufficient access control to ports in the hw/ppc/spapr.c component of the QEMU emulator. Exploitation of this issue may allow an attacker to access confidential data.

Recommendations For QEMU versions prior to 3.1.0, update to version 3.1.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the /proc/device-tree/system-id and /proc/device-tree/model system attributes to minimize the risk of exploitation.