aderumier at odiso.com
Thu May 14 08:12:08 CEST 2015
Yes, any qemu version is vunerable,
even if we don't create floppy inside the guest.
we should patch this as soon as possible
----- Mail original -----
De: "Eric Blevins" <ericlb100 at gmail.com>
À: "pve-devel" <pve-devel at pve.proxmox.com>
Envoyé: Mercredi 13 Mai 2015 18:44:08
Objet: [pve-devel] CVE-2015-3456
Is Proxmox vulnerable to CVE-2015-3456?
>From the article:
It can result in guest controlled execution of arbitrary code in, and
with privileges of, the corresponding QEMU process on the host. Worst
case scenario this can be guest to host exit with the root privileges.
Can we expect Proxmox to stop running KVM processes as root in the near future?
pve-devel mailing list
pve-devel at pve.proxmox.com
More information about the pve-devel