Base Score

LOW3.3

CVE-2019-8934

hw/ppc/spapr.c in QEMU through 3.1.0 allows Information Exposure because the hypervisor shares the /proc/device-tree/system-id and /proc/device-tree/model system attributes with a guest.

VectorLOCAL

Published Bycve@mitre.org

Published DateMar 21, 2019, 16:01

Weakness Type (CWE):CWE-668

CVSS Metrics

Base Score

3.3

Vector String

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Base Severity

LOW

Version

3.1

Attack Vector (AV)

LOCAL

Attack Complexity (AC)

LOW

Privileges Required (PR)

LOW

User Interaction (UI)

NONE

Scope (S)

UNCHANGED

Confidentiality (C)

LOW

Integrity (I)

NONE

Availability (A)

NONE

References

http://lists.opensuse.org/opensuse-security-announce/2019-04/msg00094.html
http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00040.html
http://www.openwall.com/lists/oss-security/2019/02/21/1
http://www.securityfocus.com/bid/107115
https://lists.gnu.org/archive/html/qemu-devel/2019-02/msg04821.html
https://security.netapp.com/advisory/ntap-20190411-0006/

Base Score

LOW3.3

Weakness Type (CWE):CWE-668

CVSS Metrics

Base Score

3.3

Vector String

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Base Severity

LOW

Version

3.1

Attack Vector (AV)

LOCAL

Attack Complexity (AC)

LOW

Privileges Required (PR)

LOW

User Interaction (UI)

NONE

Scope (S)

UNCHANGED

Confidentiality (C)

LOW

Integrity (I)

NONE

Availability (A)

NONE