CWE Code: 94
Vulnerability Type: privilege_escalation
CVSS Score: 6.9
CWE Name:  Improper Control of Generation of Code ('Code Injection')
Summary: ** disputed ** the disas_insn function in target/i386/translate.c in qemu before 2.9.0, when tcg mode without hardware acceleration is used, does not limit the instruction size, which allows local users to gain privileges by creating a modified basic block that injects code into a setuid program, as demonstrated by procmail. note: the vendor has stated "this bug does not violate any security guarantees qemu makes."
Access Authentication: NONE
Access Complexity: MEDIUM
Access Vector: LOCAL
Impact (C/I/A): COMPLETE/COMPLETE/COMPLETE
Published Date: 2017-04-26
Last Modified Date: 2019-10-03