Description
Multiple heap-based buffer overflows in the virtio-blk driver (hw/virtio-blk.c) in qemu-kvm 0.14.0 allow local guest users to cause a denial of service (guest crash) and possibly gain privileges via a (1) write request to the virtio_blk_handle_write function or (2) read request to the virtio_blk_handle_read function that is not properly aligned.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | qemu-kvm | 0.12.5+dfsg-5+squeeze1 | DSA-2230-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | qemu-img +2 | 2:0.12.1.2-2.160.el6 | RHSA-2011:0534 |
Advisories 2
- RHSA-2011:0534 Red Hat Security Advisory: qemu-kvm security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- DSA-2230-1 qemu-kvm - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- DSA-2230 vendor-advisory
- http://git.kernel.org/?p=virt/kvm/qemu-kvm.git%3Ba=commitdiff%3Bh=52c050236eaa4f0b5e1d160cd66dc18106445c4d
- RHSA-2011:0534 vendor-advisory
- [Qemu-devel] 20110330 virtio-blk.c handling of i/o which is not a 512 multiple mailing-list
- 44393 third-party-advisory
- 44658 third-party-advisory
- SUSE-SU-2011:0533 vendor-advisory
- kvm-virtioblk-priv-escalation(67062) vdb-entry
- 44660 third-party-advisory
- [Qemu-devel] 20110330 Re: virtio-blk.c handling of i/o which is not a 512 multiple mailing-list
- 73756 vdb-entry
- USN-1145-1 vendor-advisory
- 44900 third-party-advisory
- openSUSE-SU-2011:0510 vendor-advisory
- 44132 third-party-advisory
- FEDORA-2012-8604 vendor-advisory