Daniel Berrange

Name of the Vulnerable Software and Affected Versions: QEMU versions 2.11.0 and older Description: The issue is related to insufficient input validation in the VNC server implementation of the QEMU hardware emulator. It can be exploited by a remote attacker to cause a denial of service. A malicious remote VNC client can utilize this flaw to allocate growing memory, leading to a denial of service on the server host. Recommendations: For QEMU versions 2.11.0 and older, consider restricting access to the VNC server implementation until a patch is available. As a temporary workaround, limiting the memory allocation for the VNC server or throttling the framebuffer updates sent to the client may help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OpenStack Compute (Nova) versions prior to Grizzly 2013.1.4 and Havana 2013.2.1 **Description** The issue allows local users to read and modify live snapshots due to world-writable and world-readable permissions for the temporary directory used to store them. **Recommendations** For versions prior to Grizzly 2013.1.4 and Havana 2013.2.1, update to a version that includes the fix for this issue to prevent local users from reading and modifying live snapshots.

**Name of the Vulnerable Software and Affected Versions** QEMU versions used in Xen 4.2.x **Description** The issue allows local guest OS administrators to read arbitrary files on the host by modifying the header of a raw disk image to identify a different format. This is exploited when the guest is restarted. **Recommendations** For QEMU versions used in Xen 4.2.x, consider restricting access to the raw disk image functionality to minimize the risk of exploitation until a fix is available.

**Name of the Vulnerable Software and Affected Versions** libvirt versions 0.3.2 through 0.5.1 **Description** The issue allows local users to bypass intended access restrictions and perform administrative actions due to multiple methods in libvirt not checking if a connection is read-only. **Recommendations** For libvirt versions 0.3.2 through 0.5.1, consider restricting access to administrative actions until a patch is available. As a temporary workaround, review and enforce connection permissions to prevent unauthorized access.