CVE-2009-3616

Publication date 23 October 2009

Last updated 24 July 2024

Ubuntu priority

High

Why this priority?

Cvss 3 Severity Score

9.9 · Critical

Score breakdown

Multiple use-after-free vulnerabilities in vnc.c in the VNC server in QEMU 0.10.6 and earlier might allow guest OS users to execute arbitrary code on the host OS by establishing a connection from a VNC client and then (1) disconnecting during data transfer, (2) sending a message using incorrect integer data types, or (3) using the Fuzzy Screen Mode protocol, related to double free vulnerabilities.

Read the notes from the security team

Status

Package Ubuntu Release Status
kvm 10.10 maverick Not in release
10.04 LTS lucid Not in release
9.10 karmic Not in release
9.04 jaunty
Not affected
8.10 intrepid
Not affected
8.04 LTS hardy
Not affected
6.06 LTS dapper Not in release
qemu 10.10 maverick Not in release
10.04 LTS lucid Not in release
9.10 karmic Not in release
9.04 jaunty Ignored end of life
8.10 intrepid
Not affected
8.04 LTS hardy
Not affected
6.06 LTS dapper
Not affected
qemu-kvm 10.10 maverick
Not affected
10.04 LTS lucid
Not affected
9.10 karmic
Not affected
9.04 jaunty Not in release
8.10 intrepid Not in release
8.04 LTS hardy Not in release
6.06 LTS dapper Not in release

Notes

jdstrand

versions 0.9.1 and earlier are not affected. Need the following commit to be affected: http://git.savannah.gnu.org/cgit/qemu.git/commit/?id=753b405331. This came in 0.10.0 (from ChangeLog: 'Multiple VNC clients are now supported') kvm-84 as included in Ubuntu 9.04 does not contain the affected code (it has a pre-release version of qemu 0.10.0) kvm-84 in hardy-backports and intrepid-backports are not affected (they are based on kvm-84 from Ubuntu 9.04) simply search for VncDisplay in vnc.c to see if might be affected

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package Patch details
qemu
qemu-kvm

Severity score breakdown

Parameter Value
Base score 9.9 · Critical
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Scope Changed
Confidentiality High
Integrity impact High
Availability impact High
Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H