CVE-2010-0428

libspice: Insufficient guest provided pointers validation

Severity Score

9.8

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

libspice, as used in QEMU-KVM in the Hypervisor (aka rhev-hypervisor) in Red Hat Enterprise Virtualization (RHEV) 2.2 and qspice 0.3.0, does not properly validate guest QXL driver pointers, which allows guest OS users to cause a denial of service (invalid pointer dereference and guest OS crash) or possibly gain privileges via unspecified vectors.

libspice, tal y como se utiliza en QEMU-KVM en el Hypervisor (alias rhev-hipervisor) de Red Hat Enterprise Virtualization (RHEV) v2.2 y qspice v0.3.0, no valida correctamente los punteros a controladores QXL, lo que permite causar, a los usuarios de los sistemas operativos Huesped, una denegación de servicio (uso de puntero no válido y la caída del sistema operativo huésped) o posiblemente ganar privilegios a través de vectores no especificados.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Local

Attack Complexity

Medium

Authentication

Single

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2010-01-27 CVE Reserved
2010-08-24 CVE Published
2024-08-07 CVE Updated
2025-03-30 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-20: Improper Input Validation

CAPEC

References (4)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC
https://rhn.redhat.com/errata/RHSA-2010-0622.html	2010-08-25
https://rhn.redhat.com/errata/RHSA-2010-0633.html	2010-08-25

URL	Date	SRC
https://bugzilla.redhat.com/show_bug.cgi?id=568699	2010-08-19
https://access.redhat.com/security/cve/CVE-2010-0428	2010-08-19

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Redhat Search vendor "Redhat"		Enterprise Virtualization Search vendor "Redhat" for product "Enterprise Virtualization"				2.2 Search vendor "Redhat" for product "Enterprise Virtualization" and version "2.2"		-		Affected
Redhat Search vendor "Redhat"		Qspice Search vendor "Redhat" for product "Qspice"				0.3.0 Search vendor "Redhat" for product "Qspice" and version "0.3.0"		-		Affected