Information Disclosure

2020-04-1000:53:10

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.0004 Low

EPSS

Percentile

5.1%

JSON

kvm is vulnerable to information disclosure. The vulnerability exists as a data structure field in kvm_vcpu_ioctl_x86_get_vcpu_events() in QEMU-KVM was not initialized properly before being copied to user-space. A privileged host user with access to “/dev/kvm” could use this flaw to leak kernel stack memory to user-space.

CPENameOperatorVersion
kvmeq83__164.el5_5.23
kvmeq83__105.el5_4.22
kvmeq83__164.el5_5.9
kvmeq83__164.el5_5.25
kvmeq83__164.el5
kvmeq83__164.el5_5.12
kvmeq83__105.el5
kvmeq83__164.el5_5.15
kvmeq83__105.el5_4.7
kvmeq83__105.el5_4.1

Name	Operator	Version
kvm	eq	83__164.el5_5.23
kvm	eq	83__105.el5_4.22
kvm	eq	83__164.el5_5.9
kvm	eq	83__164.el5_5.25
kvm	eq	83__164.el5
kvm	eq	83__164.el5_5.12
kvm	eq	83__105.el5
kvm	eq	83__164.el5_5.15
kvm	eq	83__105.el5_4.7
kvm	eq	83__105.el5_4.1