CVE-2014-0222

CVE Details

Release Date:	2014-05-12
Impact:	Moderate	What is this?

Description

An integer overflow flaw was found in the QEMU block driver for QCOW version 1 disk images. A user able to alter the QEMU disk image files loaded by a guest could use this flaw to corrupt QEMU process memory on the host, which could potentially result in arbitrary code execution on the host with the privileges of the QEMU process.

See more information about CVE-2014-0222 from MITRE CVE dictionary and NIST NVD

NOTE: The following CVSS metrics and score provided are preliminary and subject to review.

CVSS v2 metrics

Base Score:	4.3
Vector String:	AV:A/AC:H/Au:N/C:P/I:P/A:P
Version:	2.0
Attack Vector:	Adjacent Network
Attack Complexity:	High
Authentication:	None
Confidentiality Impact:	Partial
Integrity Impact:	Partial
Availability Impact:	Partial

Errata information

Platform	Errata	Release Date
Oracle Linux version 6 (qemu-kvm)	ELSA-2014-1075	2014-08-19
Oracle Linux version 7 (qemu-kvm)	ELSA-2014-0927	2014-07-23