Skip to content
OpenAdvisories
Unscored USN-2342-1 32 CVEs

qemu, qemu-kvm vulnerabilities

Published Sep 8, 2014 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Michael S. Tsirkin, Anthony Liguori, and Michael Roth discovered multiple
issues with QEMU state loading after migration. An attacker able to modify
the state data could use these issues to cause a denial of service, or
possibly execute arbitrary code. (CVE-2013-4148, CVE-2013-4149,
CVE-2013-4150, CVE-2013-4151, CVE-2013-4526, CVE-2013-4527, CVE-2013-4529,
CVE-2013-4530, CVE-2013-4531, CVE-2013-4532, CVE-2013-4533, CVE-2013-4534,
CVE-2013-4535, CVE-2013-4536, CVE-2013-4537, CVE-2013-4538, CVE-2013-4539,
CVE-2013-4540, CVE-2013-4541, CVE-2013-4542, CVE-2013-6399, CVE-2014-0182,
CVE-2014-3461)

Kevin Wolf, Stefan Hajnoczi, Fam Zheng, Jeff Cody, Stefan Hajnoczi, and
others discovered multiple issues in the QEMU block drivers. An attacker
able to modify disk images could use these issues to cause a denial of
service, or possibly execute arbitrary code. (CVE-2014-0142, CVE-2014-0143,
CVE-2014-0144, CVE-2014-0145, CVE-2014-0146, CVE-2014-0147, CVE-2014-0222,
CVE-2014-0223)

It was discovered that QEMU incorrectly handled certain PCIe bus hotplug
operations. A malicious guest could use this issue to crash the QEMU host,
resulting in a denial of service. (CVE-2014-3471)

Fixed packages 1

ReleasePackageFixed in
Ubuntu · 14.04 LTS 14.04:LTS qemu 2.0.0+dfsg-2ubuntu1.3

Vulnerabilities 32

  • Unscored —
    CVE-2013-4148

    Integer signedness error in the virtio_net_load function in hw/net/virtio-net.c in QEMU 1.x before 1.7.2 allows remote …

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2013-4149

    Buffer overflow in virtio_net_load function in net/virtio-net.c in QEMU 1.3.0 through 1.7.x before 1.7.2 might allow re…

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2013-4150

    The virtio_net_load function in hw/net/virtio-net.c in QEMU 1.5.0 through 1.7.x before 1.7.2 allows remote attackers to…

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2013-4151

    The virtio_load function in virtio/virtio.c in QEMU 1.x before 1.7.2 allows remote attackers to execute arbitrary code …

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2013-4526

    Buffer overflow in hw/ide/ahci.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service and possibly…

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2013-4527

    Buffer overflow in hw/timer/hpet.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via vect…

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2013-4529

    Buffer overflow in hw/pci/pcie_aer.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service and poss…

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2013-4530

    Buffer overflow in hw/ssi/pl022.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possibly…

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2013-4531

    Buffer overflow in target-arm/machine.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service and p…

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2013-4532

    Qemu 1.1.2+dfsg to 2.1+dfsg suffers from a buffer overrun which could potentially result in arbitrary code execution on…

    QEMU QEMU qemu qemu Virtualization Debian Ubuntu
  • Unscored —
    CVE-2013-4533

    Buffer overflow in the pxa2xx_ssp_load function in hw/arm/pxa2xx.c in QEMU before 1.7.2 allows remote attackers to caus…

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2013-4534

    Buffer overflow in hw/intc/openpic.c in QEMU before 1.7.2 allows remote attackers to cause a denial of service or possi…

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2013-4535

    The virtqueue_map_sg function in hw/virtio/virtio.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary f…

    qemu qemu Virtualization Debian Ubuntu
  • Unscored —
    CVE-2013-4536

    An user able to alter the savevm data (either on the disk or over the wire during migration) could use this flaw to to …

    qemu qemu Virtualization Debian Ubuntu
  • Unscored —
    CVE-2013-4537

    The ssi_sd_transfer function in hw/sd/ssi-sd.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary code v…

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2013-4538

    Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c in QEMU before 1.7.2 allow remote attack…

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2013-4539

    Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c in QEMU before 1.7.2 might allow remote at…

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2013-4540

    Buffer overflow in scoop_gpio_handler_update in QEMU before 1.7.2 might allow remote attackers to execute arbitrary cod…

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2013-4541

    The usb_device_post_load function in hw/usb/bus.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrar…

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2013-4542

    The virtio_scsi_load_request function in hw/scsi/scsi-bus.c in QEMU before 1.7.2 might allow remote attackers to execut…

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2013-6399

    Array index error in the virtio_load function in hw/virtio/virtio.c in QEMU before 1.7.2 allows remote attackers to exe…

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2014-0142

    QEMU, possibly before 2.0.0, allows local users to cause a denial of service (divide-by-zero error and crash) via a zer…

    qemu Debian
  • Unscored —
    CVE-2014-0143

    Multiple integer overflows in the block drivers in QEMU, possibly before 2.0.0, allow local users to cause a denial of …

    qemu Debian
  • Unscored —
    CVE-2014-0144

    QEMU before 2.0.0 block drivers for CLOOP, QCOW2 version 2 and various other image formats are vulnerable to potential …

    qemu Debian
  • Unscored —
    CVE-2014-0145

    Multiple buffer overflows in QEMU before 1.7.2 and 2.x before 2.0.0, allow local users to cause a denial of service (cr…

    qemu Debian
  • Unscored —
    CVE-2014-0146

    The qcow2_open function in the (block/qcow2.c) in QEMU before 1.7.2 and 2.x before 2.0.0 allows local users to cause a …

    qemu Debian
  • Unscored —
    CVE-2014-0147

    Qemu before 1.6.2 block diver for the various disk image formats used by Bochs and for the QCOW version 2 format, are v…

    qemu Virtualization Debian
  • Unscored —
    CVE-2014-0182

    Heap-based buffer overflow in the virtio_load function in hw/virtio/virtio.c in QEMU before 1.7.2 might allow remote at…

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2014-0222

    Integer overflow in the qcow_open function in block/qcow.c in QEMU before 1.7.2 allows remote attackers to cause a deni…

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2014-0223

    Integer overflow in the qcow_open function in block/qcow.c in QEMU before 1.7.2 allows local users to cause a denial of…

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2014-3461

    hw/usb/bus.c in QEMU 1.6.2 allows remote attackers to execute arbitrary code via crafted savevm data, which triggers a …

    qemu qemu Debian Ubuntu
  • Unscored —
    CVE-2014-3471

    Use-after-free vulnerability in hw/pci/pcie.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denia…

    qemu qemu Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2013-4148
  • report
    https://ubuntu.com/security/CVE-2013-4149
  • report
    https://ubuntu.com/security/CVE-2013-4150
  • report
    https://ubuntu.com/security/CVE-2013-4151
  • report
    https://ubuntu.com/security/CVE-2013-4526
  • report
    https://ubuntu.com/security/CVE-2013-4527
  • report
    https://ubuntu.com/security/CVE-2013-4529
  • report
    https://ubuntu.com/security/CVE-2013-4530
  • report
    https://ubuntu.com/security/CVE-2013-4531
  • report
    https://ubuntu.com/security/CVE-2013-4532
  • report
    https://ubuntu.com/security/CVE-2013-4533
  • report
    https://ubuntu.com/security/CVE-2013-4534
  • report
    https://ubuntu.com/security/CVE-2013-4535
  • report
    https://ubuntu.com/security/CVE-2013-4536
  • report
    https://ubuntu.com/security/CVE-2013-4537
  • report
    https://ubuntu.com/security/CVE-2013-4538
  • report
    https://ubuntu.com/security/CVE-2013-4539
  • report
    https://ubuntu.com/security/CVE-2013-4540
  • report
    https://ubuntu.com/security/CVE-2013-4541
  • report
    https://ubuntu.com/security/CVE-2013-4542
  • report
    https://ubuntu.com/security/CVE-2013-6399
  • report
    https://ubuntu.com/security/CVE-2014-0142
  • report
    https://ubuntu.com/security/CVE-2014-0143
  • report
    https://ubuntu.com/security/CVE-2014-0144
  • report
    https://ubuntu.com/security/CVE-2014-0145
  • report
    https://ubuntu.com/security/CVE-2014-0146
  • report
    https://ubuntu.com/security/CVE-2014-0147
  • report
    https://ubuntu.com/security/CVE-2014-0182
  • report
    https://ubuntu.com/security/CVE-2014-0222
  • report
    https://ubuntu.com/security/CVE-2014-0223
  • report
    https://ubuntu.com/security/CVE-2014-3461
  • report
    https://ubuntu.com/security/CVE-2014-3471