Description
A flaw was found in the way QEMU handled VT100 terminal escape sequences
when emulating certain character devices. A guest user with privileges to
write to a character device that is emulated on the host using a virtual
console back-end could use this flaw to crash the qemu-kvm process on the
host or, possibly, escalate their privileges on the host. (CVE-2012-3515)
This flaw did not affect the default use of KVM. Affected configurations
were:
* When guests were started from the command line ("/usr/libexec/qemu-kvm"),
and without specifying a serial or parallel device that specifically does
not use a virtual console (vc) back-end. (Note that Red Hat does not
support invoking "qemu-kvm" from the command line on Red Hat Enterprise
Linux 5.)
* Guests that were managed via libvirt, such as when using Virtual Machine
Manager (virt-manager), but that have a serial or parallel device that uses
a virtual console back-end. By default, guests managed via libvirt will not
use a virtual console back-end for such devices.