Description
Qemu, as used in Xen 4.0, 4.1 and possibly other products, when emulating certain devices with a virtual console backend, allows local OS guest users to gain privileges via a crafted escape VT100 sequence that triggers the overwrite of a "device model's address space."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | qemu | 1.1.2+dfsg-1 | — |
| Debian 14 | xen | 4.1.3-2 | — |
| Debian 13 | qemu | 1.1.2+dfsg-1 | — |
| Debian 13 | xen | 4.1.3-2 | — |
| Debian 12 | qemu | 1.1.2+dfsg-1 | — |
| Debian 12 | xen | 4.1.3-2 | — |
| Debian 6.0 | qemu | 0.12.5+dfsg-3squeeze2 | DSA-2545-1 |
| Debian 6.0 | qemu-kvm | 0.12.5+dfsg-5+squeeze9 | DSA-2542-1 |
| Debian 6.0 | xen-qemu-dm-4.0 | 4.0.1-2+squeeze2 | DSA-2543-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | qemu-img +6 | 2:0.12.1.2-2.295.el6_3.2 | RHSA-2012:1234, RHSA-2012:1233 |
| RHEL 6 | rhev-hypervisor6 | 6.3-20120926.0.el6_3 | RHSA-2012:1325 |
| RHEL 5 | xen +1 | 3.0.3-135.el5_8.5 | RHSA-2012:1236 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Virtualization 5 | kvm +4 | 83-249.el5_8.5 | RHSA-2012:1235 |
| Red Hat Rhel Virtualization 5 | xen +1 | 3.0.3-135.el5_8.5 | RHSA-2012:1236 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | qemu +1 | 2.6.1-1.5 | openSUSE-SU-2024:10285-1, openSUSE-SU-2024:10233-1 |
Advisories 10
- RHSA-2012:1325 Red Hat Security Advisory: rhev-hypervisor6 security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2012:1236 Red Hat Security Advisory: xen security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2012:1234 Red Hat Security Advisory: qemu-kvm security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2012:1235 Red Hat Security Advisory: kvm security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2012:1233 Red Hat Security Advisory: qemu-kvm-rhev security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- DSA-2542-1 qemu-kvm - multiple Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-2545-1 qemu - multiple Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-2543-1 xen-qemu-dm-4.0 - multiple Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10285-1 qemu-linux-user-2.6.1-1.5 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10233-1 qemu-2.6.1-1.5 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 55082 third-party-advisory
- 50528 third-party-advisory
- RHSA-2012:1234 vendor-advisory
- 50530 third-party-advisory
- http://git.qemu.org/?p=qemu-stable-0.15.git%3Ba=log
- 51413 third-party-advisory
- GLSA-201309-24 vendor-advisory
- 50689 third-party-advisory
- DSA-2543 vendor-advisory
- SUSE-SU-2012:1135 vendor-advisory
- 50632 third-party-advisory
- RHSA-2012:1325 vendor-advisory
- RHSA-2012:1236 vendor-advisory
- SUSE-SU-2012:1205 vendor-advisory
- SUSE-SU-2012:1202 vendor-advisory
- 50913 third-party-advisory
- openSUSE-SU-2012:1572 vendor-advisory
- 50472 third-party-advisory
- openSUSE-SU-2012:1170 vendor-advisory
- USN-1590-1 vendor-advisory
- RHSA-2012:1262 vendor-advisory
- openSUSE-SU-2012:1153 vendor-advisory
- http://wiki.xen.org/wiki/Security_Announcements#XSA-17_Qemu_VT100_emulation_vulnerability
- SUSE-SU-2012:1203 vendor-advisory
- 55413 vdb-entry
- SUSE-SU-2012:1162 vendor-advisory
- openSUSE-SU-2012:1174 vendor-advisory
- SUSE-SU-2012:1320 vendor-advisory
- GLSA-201604-03 vendor-advisory
- RHSA-2012:1233 vendor-advisory
- SUSE-SU-2012:1132 vendor-advisory
- http://support.citrix.com/article/CTX134708
- DSA-2545 vendor-advisory
- SUSE-SU-2012:1129 vendor-advisory
- [Xen-announce] 20120905 Xen Security Advisory 17 (CVE-2012-3515) - Qemu VT100 emulation vulnerability mailing-list
- SUSE-SU-2012:1133 vendor-advisory
- RHSA-2012:1235 vendor-advisory
- openSUSE-SU-2012:1573 vendor-advisory
- [oss-security] 20120905 Xen Security Advisory 17 (CVE-2012-3515) - Qemu VT100 emulation vulnerability mailing-list
- openSUSE-SU-2012:1172 vendor-advisory
- 50860 third-party-advisory