Description
The change_process_uid function in os-posix.c in Qemu 0.14.0 and earlier does not properly drop group privileges when the -runas option is used, which allows local guest users to access restricted files on the host.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 6.0 | qemu-kvm | 0.12.5+dfsg-5+squeeze6 | DSA-2282-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | qemu-img +2 | 2:0.12.1.2-2.209.el6 | RHSA-2011:1531 |
Advisories 2
- RHSA-2011:1531 Red Hat Security Advisory: qemu-kvm security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- DSA-2282-1 qemu-kvm - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- qemu-runas-priv-escalation(68539) vdb-entry
- [oss-security] 20110712 CVE Request: qemu -runas does not clear supplementary groups mailing-list
- 48659 vdb-entry
- [oss-security] 20110712 Re: CVE Request: qemu -runas does not clear supplementary groups mailing-list
- DSA-2282 vendor-advisory
- 47992 third-party-advisory
- 45419 third-party-advisory
- https://bugs.launchpad.net/qemu/+bug/807893
- openSUSE-SU-2012:0207 vendor-advisory
- 74752 vdb-entry
- 47157 third-party-advisory
- 45188 third-party-advisory
- USN-1177-1 vendor-advisory
- 45187 third-party-advisory
- FEDORA-2012-8604 vendor-advisory
- RHSA-2011:1531 vendor-advisory