NetSight
IP …
low2.1

CVE-2011-2527

The change_process_uid function in os-posix.c in Qemu 0.14.0 and earlier does not properly drop group privileges when the -runas option is used, which allows l…

Impact

The change_process_uid function in os-posix.c in Qemu 0.14.0 and earlier does not properly drop group privileges when the -runas option is used, which allows local guest users to access restricted files on the host.

Affected products

VendorProductAffected versions
QemuQemu
through 0.14.0
Versions 0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.1.4

Weakness classification

CWE-264

References