CVE-2013-4536

HighCVSS 7.8/10Last modified Jun 16, 2026

Description

An user able to alter the savevm data (either on the disk or over the wire during migration) could use this flaw to to corrupt QEMU process memory on the (destination) host, which could potentially result in arbitrary code execution on the host with the privileges of the QEMU process.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-269

Affected software

Vendor	Product	Versions
n/a	qemu	qemu-kvm 1.5.3

References

https://bugzilla.redhat.com/show_bug.cgi?id=1066401Issue Tracking, Patch, Third Party Advisory
https://security.netapp.com/advisory/ntap-20210727-0002/Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1066401Issue Tracking, Patch, Third Party Advisory
https://security.netapp.com/advisory/ntap-20210727-0002/Third Party Advisory

Timeline

Published: May 28, 2021
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2013

CVE-2013-45377.5The ssi_sd_transfer function in hw/sd/ssi-sd.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary code via a crafted arglen v CVE-2013-45387.5Multiple buffer overflows in the ssd0323_load function in hw/display/ssd0323.c in QEMU before 1.7.2 allow remote attackers to cause a denial CVE-2013-45397.5Multiple buffer overflows in the tsc210x_load function in hw/input/tsc210x.c in QEMU before 1.7.2 might allow remote attackers to execute ar CVE-2013-45407.5Buffer overflow in scoop_gpio_handler_update in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a large (1) pre CVE-2013-45417.5The usb_device_post_load function in hw/usb/bus.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted CVE-2013-45427.5The virtio_scsi_load_request function in hw/scsi/scsi-bus.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via CVE-2013-45444.9hw/net/vmxnet3.c in QEMU 2.0.0-rc0, 1.7.1, and earlier allows local guest users to cause a denial of service or possibly execute arbitrary c CVE-2013-45454.3cURL and libcurl 7.18.0 through 7.32.0, when built with OpenSSL, disables the certificate CN and SAN name field verification (CURLOPT_SSL_VE CVE-2013-45466.5The repository import feature in gitlab-shell before 1.7.4, as used in GitLab, allows remote authenticated users to execute arbitrary comman CVE-2013-45477.5nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescaped space character i CVE-2013-45486.0The mm_newkeys_from_blob function in monitor_wrap.c in sshd in OpenSSH 6.2 and 6.3, when an AES-GCM cipher is used, does not properly initia CVE-2013-45495.0QXmlSimpleReader in Qt before 5.2 allows context-dependent attackers to cause a denial of service (memory consumption) via an XML Entity Exp