Quick Emulator(Qemu) built with the VirtFS, host directory sharing via Plan 9 File System(9pfs) support, is vulnerable to an information leakage issue. It could occur by accessing xattribute value before it's written to. A privileged user inside guest could use this flaw to leak host memory bytes. Upstream patches: ----------------- -> https://lists.gnu.org/archive/html/qemu-devel/2016-10/msg01790.html Reference: ---------- -> http://wiki.qemu.org/Documentation/9psetup
Acknowledgments: Name: Li Qiang (360.cn Inc.)
Created xen tracking bugs for this issue: Affects: fedora-all [bug 1389644]
Created qemu tracking bugs for this issue: Affects: fedora-all [bug 1389643]
CVE assignment: http://seclists.org/oss-sec/2016/q4/279
commit eb687602853b4ae656e9236ee4222609f3a6887d Author: Li Qiang <liqiang6-s> Date: Mon Oct 17 14:13:58 2016 +0200 9pfs: fix information leak in xattr read