Qemu, as used in Xen 4.0, 4.1 and possibly other products, when emulating certain devices…
Priority LOW 32CWE-20Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Complete · Complete · Complete
- Fix status
- Partial Red Hat: 10 fixed, 1 without a fix
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat.
Summary
Qemu, as used in Xen 4.0, 4.1 and possibly other products, when emulating certain devices with a virtual console backend, allows local OS guest users to gain privileges via a crafted escape VT100 sequence that triggers the overwrite of a "device model's address space."
Why it matters now
EPSS 0.00528 44th percentileScored 2026-11-07
Fix Partial Red Hat: 5 advisoriesRed Hat: 10 fixed, 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 33
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:* | before 1.2.0 | Vulnerable | QEMU |
| cpe:2.3:o:xen:xen:4.0.0:*:*:*:*:*:*:* | 4.0.0 | Vulnerable | Xen |
| cpe:2.3:o:xen:xen:4.1.0:*:*:*:*:*:*:* | 4.1.0 | Vulnerable | Xen |
| cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:* | 11.4 | Vulnerable | openSUSE |
| cpe:2.3:o:opensuse:opensuse:12.1:*:*:*:*:*:*:* | 12.1 | Vulnerable | openSUSE |
| cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:* | 12.2 | Vulnerable | openSUSE |
| cpe:2.3:o:suse:linux_enterprise_desktop:10:sp4:*:*:*:*:*:* | 10 sp4 | Vulnerable | SUSE |
| cpe:2.3:o:suse:linux_enterprise_desktop:11:sp2:*:*:*:*:*:* | 11 sp2 | Vulnerable | SUSE |
| cpe:2.3:o:suse:linux_enterprise_server:10:sp2:*:*:*:*:*:* | 10 sp2 | Vulnerable | SUSE |
| cpe:2.3:o:suse:linux_enterprise_server:10:sp3:*:*:ltss:*:*:* | 10 sp3 | Vulnerable | SUSE |
- cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:* Versions before 1.2.0 Vulnerable ·QEMU
- cpe:2.3:o:xen:xen:4.0.0:*:*:*:*:*:*:* Versions 4.0.0 Vulnerable ·Xen
- cpe:2.3:o:xen:xen:4.1.0:*:*:*:*:*:*:* Versions 4.1.0 Vulnerable ·Xen
- cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:* Versions 11.4 Vulnerable ·openSUSE
- cpe:2.3:o:opensuse:opensuse:12.1:*:*:*:*:*:*:* Versions 12.1 Vulnerable ·openSUSE
- cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:* Versions 12.2 Vulnerable ·openSUSE
- cpe:2.3:o:suse:linux_enterprise_desktop:10:sp4:*:*:*:*:*:* Versions 10 sp4 Vulnerable ·SUSE
- cpe:2.3:o:suse:linux_enterprise_desktop:11:sp2:*:*:*:*:*:* Versions 11 sp2 Vulnerable ·SUSE
- cpe:2.3:o:suse:linux_enterprise_server:10:sp2:*:*:*:*:*:* Versions 10 sp2 Vulnerable ·SUSE
- cpe:2.3:o:suse:linux_enterprise_server:10:sp3:*:*:ltss:*:*:* Versions 10 sp3 Vulnerable ·SUSE
Show 23 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:*:*:*:* | 10 sp4 | Vulnerable | SUSE |
| cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:ltss:*:*:* | 11 sp1 | Vulnerable | SUSE |
| cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:-:*:* | 11 sp2 | Vulnerable | SUSE |
| cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:vmware:*:* | 11 sp2 | Vulnerable | SUSE |
| cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp4:*:*:*:*:*:* | 10 sp4 | Vulnerable | SUSE |
| cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp2:*:*:*:*:*:* | 11 sp2 | Vulnerable | SUSE |
| cpe:2.3:a:redhat:virtualization:3.0:*:*:*:*:*:*:* | 3.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* | 6.0 | Running on | Red Hat |
| cpe:2.3:a:redhat:virtualization:5.0:*:*:*:*:*:*:* | 5.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:virtualization:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:* | 5.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_eus:6.3:*:*:*:*:*:*:* | 6.3 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:* | 5.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:* | 5.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Red Hat |
| cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Debian |
| cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:* | 10.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:11.04:*:*:*:*:*:*:* | 11.04 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:* | 11.10 | Vulnerable | Canonical |
| cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:* | 12.04 | Vulnerable | Canonical |
- cpe:2.3:o:suse:linux_enterprise_server:10:sp4:*:*:*:*:*:* Versions 10 sp4 Vulnerable ·SUSE
- cpe:2.3:o:suse:linux_enterprise_server:11:sp1:*:*:ltss:*:*:* Versions 11 sp1 Vulnerable ·SUSE
- cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:-:*:* Versions 11 sp2 Vulnerable ·SUSE
- cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:*:vmware:*:* Versions 11 sp2 Vulnerable ·SUSE
- cpe:2.3:o:suse:linux_enterprise_software_development_kit:10:sp4:*:*:*:*:*:* Versions 10 sp4 Vulnerable ·SUSE
- cpe:2.3:o:suse:linux_enterprise_software_development_kit:11:sp2:*:*:*:*:*:* Versions 11 sp2 Vulnerable ·SUSE
- cpe:2.3:a:redhat:virtualization:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Running on ·Red Hat
- cpe:2.3:a:redhat:virtualization:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:virtualization:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_desktop:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_eus:6.3:*:*:*:*:*:*:* Versions 6.3 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_server:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_workstation:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
- cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Debian
- cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:* Versions 10.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:11.04:*:*:*:*:*:*:* Versions 11.04 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:* Versions 11.10 Vulnerable ·Canonical
- cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:* Versions 12.04 Vulnerable ·Canonical
Remediation
Red Hat 5 advisories
- RHSA-2012:1325 Released 2012-10-02 · Red Hat rating Importantrhev-hypervisor6 security and bug fix update
- RHEV Hypervisor for RHEL-6 rhev-hypervisor6-6.3-20120926.0.el6_3
- RHSA-2012:1236 Released 2012-09-05 · Red Hat rating Importantxen security update
- RHEL Desktop Multi OS (v. 5 client) xen-3.0.3-135.el5_8.5, xen-3.0.3-135.el5_8.5.i386, xen-devel-3.0.3-135.el5_8.5 +1
- RHEL Virtualization (v. 5 server) xen-3.0.3-135.el5_8.5, xen-3.0.3-135.el5_8.5.i386, xen-3.0.3-135.el5_8.5.ia64 +3
- Red Hat Enterprise Linux (v. 5 server) xen-3.0.3-135.el5_8.5, xen-libs-3.0.3-135.el5_8.5, xen-libs-3.0.3-135.el5_8.5.i386 +1
- Red Hat Enterprise Linux Desktop (v. 5 client) xen-3.0.3-135.el5_8.5, xen-libs-3.0.3-135.el5_8.5, xen-libs-3.0.3-135.el5_8.5.i386
- RHSA-2012:1235 Released 2012-09-05 · Red Hat rating Importantkvm security update
- RHEL Desktop Multi OS (v. 5 client) kmod-kvm-83-249.el5_8.5, kmod-kvm-debug-83-249.el5_8.5, kvm-83-249.el5_8.5 +2
- RHEL Virtualization (v. 5 server) kmod-kvm-83-249.el5_8.5, kmod-kvm-debug-83-249.el5_8.5, kvm-83-249.el5_8.5 +2
Show 2 more Red Hat advisories
- RHSA-2012:1234 Released 2012-09-05 · Red Hat rating Importantqemu-kvm security update
- Red Hat Enterprise Linux Desktop (v. 6) qemu-guest-agent-2:0.12.1.2-2.295.el6_3.2, qemu-img-2:0.12.1.2-2.295.el6_3.2, qemu-kvm-2:0.12.1.2-2.295.el6_3.2 +1
- Red Hat Enterprise Linux HPC Node (v. 6) qemu-guest-agent-2:0.12.1.2-2.295.el6_3.2, qemu-img-2:0.12.1.2-2.295.el6_3.2, qemu-kvm-2:0.12.1.2-2.295.el6_3.2 +1
- Red Hat Enterprise Linux Server (v. 6) qemu-guest-agent-2:0.12.1.2-2.295.el6_3.2, qemu-img-2:0.12.1.2-2.295.el6_3.2, qemu-kvm-2:0.12.1.2-2.295.el6_3.2 +1
- Red Hat Enterprise Linux Workstation (v. 6) qemu-guest-agent-2:0.12.1.2-2.295.el6_3.2, qemu-img-2:0.12.1.2-2.295.el6_3.2, qemu-kvm-2:0.12.1.2-2.295.el6_3.2 +1
- RHSA-2012:1233 Released 2012-09-05 · Red Hat rating Importantqemu-kvm-rhev security and bug fix update
- RHEV Agents (vdsm) qemu-img-rhev-2:0.12.1.2-2.295.el6_3.2, qemu-kvm-rhev-2:0.12.1.2-2.295.el6_3.2, qemu-kvm-rhev-tools-2:0.12.1.2-2.295.el6_3.2
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 5 | Affected | No fix yet |
| RHEL Desktop Multi OS (v. 5 client) | Fixed | RHSA-2012:1235, RHSA-2012:1236 |
| RHEL Virtualization (v. 5 server) | Fixed | RHSA-2012:1235, RHSA-2012:1236 |
| RHEV Agents (vdsm) | Fixed | RHSA-2012:1233 |
| RHEV Hypervisor for RHEL-6 | Fixed | RHSA-2012:1325 |
| Red Hat Enterprise Linux (v. 5 server) | Fixed | RHSA-2012:1236 |
| Red Hat Enterprise Linux Desktop (v. 5 client) | Fixed | RHSA-2012:1236 |
| Red Hat Enterprise Linux Desktop (v. 6) | Fixed | RHSA-2012:1234 |
| Red Hat Enterprise Linux HPC Node (v. 6) | Fixed | RHSA-2012:1234 |
| Red Hat Enterprise Linux Server (v. 6) | Fixed | RHSA-2012:1234 |
| Red Hat Enterprise Linux Workstation (v. 6) | Fixed | RHSA-2012:1234 |
Timeline
- 2026-10-02 Threatist record created from CVE-2012-3515
- 2026-10-03 Alias added: GHSA-rwhm-5hjg-54j9
References
Advisory 30
- RHSA-2012:1234
- GLSA-201309-24
- DSA-2543
- SUSE-SU-2012:1135
- RHSA-2012:1325
- RHSA-2012:1236
- SUSE-SU-2012:1205
- SUSE-SU-2012:1202
- openSUSE-SU-2012:1572
- openSUSE-SU-2012:1170
- USN-1590-1
- RHSA-2012:1262
- openSUSE-SU-2012:1153
- http://wiki.xen.org/wiki/Security_Announcements#XSA-17_Qemu_VT100_emulation_vulnerability
- SUSE-SU-2012:1203
- SUSE-SU-2012:1162
- openSUSE-SU-2012:1174
- SUSE-SU-2012:1320
- GLSA-201604-03
- RHSA-2012:1233
- SUSE-SU-2012:1132
- http://support.citrix.com/article/CTX134708
- DSA-2545
- SUSE-SU-2012:1129
- [Xen-announce] 20120905 Xen Security Advisory 17 (CVE-2012-3515) - Qemu VT100 emulation vulnerability
- SUSE-SU-2012:1133
- RHSA-2012:1235
- openSUSE-SU-2012:1573
- [oss-security] 20120905 Xen Security Advisory 17 (CVE-2012-3515) - Qemu VT100 emulation vulnerability
- openSUSE-SU-2012:1172
Sources
- CVE-2012-3515 · CVE Program
- CVE-2012-3515 · NVD
- FIRST EPSS
- GHSA-rwhm-5hjg-54j9 · GitHub Advisory Database · CC BY 4.0
- CVE-2012-3515 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences