Description
Buffer overflow in the SCSI implementation in QEMU, as used in Xen, when a SCSI controller has more than 256 attached devices, allows local users to gain privileges via a small transfer buffer in a REPORT LUNS command.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | qemu | 1.6.0+dfsg-2 | — |
| Debian 14 | xen | 4.2-1 | — |
| Debian 13 | qemu | 1.6.0+dfsg-2 | — |
| Debian 13 | xen | 4.2-1 | — |
| Debian 12 | qemu | 1.6.0+dfsg-2 | — |
| Debian 12 | xen | 4.2-1 | — |
| Debian 7 | qemu | 1.1.2+dfsg-6a+deb7u3 | DSA-2932-1 |
| Debian 7 | qemu-kvm | 1.1.2+dfsg-6+deb7u3 | DSA-2933-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | qemu-img +6 | 2:0.12.1.2-2.415.el6 | RHSA-2013:1754, RHSA-2013:1553 |
| RHEL 6 | rhev-hypervisor6 | 6.5-20131115.0.3.2.el6_5 | RHSA-2013:1527 |
Advisories 5
- RHSA-2013:1754 Red Hat Security Advisory: qemu-kvm-rhev, qemu-kvm-rhev-tools, qemu-img-rhev security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2013:1553 Red Hat Security Advisory: qemu-kvm security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2013:1527 Red Hat Security Advisory: rhev-hypervisor6 security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- DSA-2932-1 qemu - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-2933-1 qemu-kvm - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- openSUSE-SU-2014:1281 vendor-advisory
- 62773 vdb-entry
- [qemu-devel] 20131009 [ANNOUNCE] QEMU 1.6.1 Stable released mailing-list
- openSUSE-SU-2014:1279 vendor-advisory
- [oss-security] 20131002 Xen Security Advisory 65 (CVE-2013-4344) - qemu SCSI REPORT LUNS buffer overflow mailing-list
- 98028 vdb-entry
- RHSA-2013:1754 vendor-advisory
- RHSA-2013:1553 vendor-advisory
- USN-2092-1 vendor-advisory