CVE-2019-12928

Name of the Vulnerable Software and Affected Versions QEMU versions 4.0.0 and earlier

Description The QMP migrate command in QEMU is vulnerable to OS command injection, allowing a remote attacker to achieve code execution, denial of service, or information disclosure by sending a crafted QMP command to the listening server. Note that this issue has been disputed as a non-issue since QEMU's -qmp interface is meant to be used by trusted users, and accessing this interface via a tcp socket open to the internet is considered an insecure configuration issue.

Recommendations For QEMU versions 4.0.0 and earlier, consider restricting access to the QMP interface to trusted users only, and avoid exposing the -qmp interface to the internet via a tcp socket. As a temporary workaround, consider disabling the QMP migrate command until a secure configuration can be implemented. At the moment, there is no information about a newer version that contains a fix for this vulnerability.