CVE-2013-4151

Advisory lineage Upstream: 0 Downstream: 11
Modified
Published: 04 Nov 2014, 21:00
Last modified:06 Aug 2024, 16:30

Vulnerability Summary

Overall Risk (default)
medium
30/100
CVSS Score
7.5 HIGH
v2.0 (nvd)
EPSS Score
1.39% LOW
1% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

04 Nov 2014, 21:00
Published
Vulnerability first disclosed
06 Aug 2024, 16:30
Last Modified
Vulnerability information updated

Description

The virtio_load function in virtio/virtio.c in QEMU 1.x before 1.7.2 allows remote attackers to execute arbitrary code via a crafted savevm image, which triggers an out-of-bounds write.

CVSS Metrics

  • v2.0•HIGH•Score: 7.5AV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS Trends

Current EPSS score: 1.39%• Percentile: 81%

Techniques & Countermeasures

  • CWE-94•Improper Control of Generation of Code ('Code Injection')

    The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Affected Systems

  • qemu•qemu

    1.0 | 1.0:rc1 | 1.0:rc2 | 1.0:rc3 | 1.0:rc4 | 1.0.1 | 1.1 | 1.1:rc1 | 1.1:rc2 | 1.1:rc3 | 1.1:rc4 | 1.4.1 | 1.4.2 | 1.5.0 | 1.5.0:rc1 | 1.5.0:rc2 | 1.5.0:rc3 | 1.5.1 | 1.5.2 | 1.5.3 | 1.6.0 | 1.6.0:rc1 | 1.6.0:rc2 | 1.6.0:rc3 | 1.6.1 | 1.6.2 | 1.7.1

References (5)