CVE-2008-0928

NameCVE-2008-0928
DescriptionQemu 0.9.1 and earlier does not perform range checks for block device read or write requests, which allows guest host users with root privileges to access arbitrary memory and escape the virtual machine.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-1799-1, DTSA-133-1
NVD severitymedium
Debian Bugs469649, 469654, 469662, 469666

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
qemu (PTS)stretch1:2.8+dfsg-6+deb9u8fixed
stretch (security)1:2.8+dfsg-6+deb9u9fixed
buster, buster (security)1:3.1+dfsg-8+deb10u5fixed
bullseye1:5.0-5fixed
sid1:5.0-6fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
kvmsource(unstable)63+dfsg-1469666
kvmsourcelenny60+dfsg-1+lenny1DTSA-133-1
qemusource(unstable)0.9.1+svn20081207-1low469649
qemusourceetch0.8.2-4etch3DSA-1799-1
qemusourcelenny0.9.1-10lenny1DSA-1799-1
xen-3source(unstable)3.2.0-4469662
xen-3.0source(unstable)(unfixed)
xen-unstablesource(unstable)3.2.0-4469654

Search for package or bug name: Reporting problems