CVE-2008-0928

NameCVE-2008-0928
DescriptionQemu 0.9.1 and earlier does not perform range checks for block device read or write requests, which allows guest host users with root privileges to access arbitrary memory and escape the virtual machine.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-1799-1, DTSA-133-1
NVD severitymedium
Debian Bugs469649, 469654, 469662, 469666

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
qemu (PTS)jessie1:2.1+dfsg-12+deb8u6fixed
jessie (security)1:2.1+dfsg-12+deb8u12fixed
stretch (security), stretch1:2.8+dfsg-6+deb9u8fixed
buster1:3.1+dfsg-8+deb10u2fixed
buster (security)1:3.1+dfsg-8+deb10u3fixed
bullseye, sid1:4.1-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
kvmsource(unstable)63+dfsg-1469666
kvmsourcelenny60+dfsg-1+lenny1DTSA-133-1
qemusource(unstable)0.9.1+svn20081207-1low469649
qemusourceetch0.8.2-4etch3DSA-1799-1
qemusourcelenny0.9.1-10lenny1DSA-1799-1
xen-3source(unstable)3.2.0-4469662
xen-3.0source(unstable)(unfixed)
xen-unstablesource(unstable)3.2.0-4469654

Search for package or bug name: Reporting problems