Nixpkgs security tracker

Login with GitHub

⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Suggestion detail

Untriaged

Permalink CVE-2013-4535

created 1 month, 3 weeks ago

The virtqueue_map_sg function in hw/virtio/virtio.c in QEMU before 1.7.2 allows …

The virtqueue_map_sg function in hw/virtio/virtio.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary files via a crafted savevm image, related to virtio-block or virtio-serial read.

References

http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html x_refsource_MISC
http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=36cf2a37132c7f01fa9adb5f95f5… x_refsource_MISC
http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html x_refsource_MISC
http://rhn.redhat.com/errata/RHSA-2014-0743.html x_refsource_MISC
http://rhn.redhat.com/errata/RHSA-2014-0744.html x_refsource_MISC
https://bugzilla.redhat.com/show_bug.cgi?id=1066401 x_refsource_MISC
http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html x_transferredx_refsource_MISC
http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=36cf2a37132c7f01fa9adb5f95f5… x_transferredx_refsource_MISC
http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html x_transferredx_refsource_MISC
http://rhn.redhat.com/errata/RHSA-2014-0743.html x_transferredx_refsource_MISC
http://rhn.redhat.com/errata/RHSA-2014-0744.html x_transferredx_refsource_MISC
https://bugzilla.redhat.com/show_bug.cgi?id=1066401 x_transferredx_refsource_MISC
http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html x_refsource_MISC
http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=36cf2a37132c7f01fa9adb5f95f5… x_refsource_MISC
http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html x_refsource_MISC
http://rhn.redhat.com/errata/RHSA-2014-0743.html x_refsource_MISC
http://rhn.redhat.com/errata/RHSA-2014-0744.html x_refsource_MISC
https://bugzilla.redhat.com/show_bug.cgi?id=1066401 x_refsource_MISC
http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html x_transferredx_refsource_MISC
http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=36cf2a37132c7f01fa9adb5f95f5… x_transferredx_refsource_MISC
http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html x_transferredx_refsource_MISC
http://rhn.redhat.com/errata/RHSA-2014-0743.html x_transferredx_refsource_MISC
http://rhn.redhat.com/errata/RHSA-2014-0744.html x_transferredx_refsource_MISC
https://bugzilla.redhat.com/show_bug.cgi?id=1066401 x_transferredx_refsource_MISC
http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html x_refsource_MISC
http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=36cf2a37132c7f01fa9adb5f95f5… x_refsource_MISC
http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html x_refsource_MISC
http://rhn.redhat.com/errata/RHSA-2014-0743.html x_refsource_MISC
http://rhn.redhat.com/errata/RHSA-2014-0744.html x_refsource_MISC
https://bugzilla.redhat.com/show_bug.cgi?id=1066401 x_refsource_MISC
http://lists.nongnu.org/archive/html/qemu-stable/2014-07/msg00187.html x_transferredx_refsource_MISC
http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=36cf2a37132c7f01fa9adb5f95f5… x_transferredx_refsource_MISC
http://lists.fedoraproject.org/pipermail/package-announce/2014-May/133345.html x_transferredx_refsource_MISC
http://rhn.redhat.com/errata/RHSA-2014-0743.html x_transferredx_refsource_MISC
http://rhn.redhat.com/errata/RHSA-2014-0744.html x_transferredx_refsource_MISC
https://bugzilla.redhat.com/show_bug.cgi?id=1066401 x_transferredx_refsource_MISC

Affected products

QEMU

==before 1.7.2

Matching in nixpkgs

pkgs.qemu

Generic and open source machine emulator and virtualizer

nixos-unstable 10.2.0
- nixpkgs-unstable 10.2.0
- nixos-unstable-small 10.2.0
nixos-25.11 10.1.2
- nixos-25.11-small 10.1.2
- nixpkgs-25.11-darwin 10.1.2

pkgs.qemu_kvm

Generic and open source machine emulator and virtualizer

nixos-unstable 10.2.0
- nixpkgs-unstable 10.2.0
- nixos-unstable-small 10.2.0
nixos-25.11 10.1.2
- nixos-25.11-small 10.1.2
- nixpkgs-25.11-darwin 10.1.2

pkgs.qemu_xen

Generic and open source machine emulator and virtualizer

nixos-unstable 10.2.0
- nixpkgs-unstable 10.2.0
- nixos-unstable-small 10.2.0
nixos-25.11 10.1.2
- nixos-25.11-small 10.1.2
- nixpkgs-25.11-darwin 10.1.2

pkgs.qemu-user

QEMU User space emulator - launch executables compiled for one CPU on another CPU

nixos-unstable 10.2.0
- nixpkgs-unstable 10.2.0
- nixos-unstable-small 10.2.0
nixos-25.11 10.1.2
- nixos-25.11-small 10.1.2
- nixpkgs-25.11-darwin 10.1.2

pkgs.qemu_full

Generic and open source machine emulator and virtualizer

nixos-unstable 10.2.0
- nixpkgs-unstable 10.2.0
- nixos-unstable-small 10.2.0
nixos-25.11 10.1.2
- nixos-25.11-small 10.1.2
- nixpkgs-25.11-darwin 10.1.2

pkgs.qemu_test

Generic and open source machine emulator and virtualizer

nixos-unstable 10.2.0
- nixpkgs-unstable 10.2.0
- nixos-unstable-small 10.2.0
nixos-25.11 10.1.2
- nixos-25.11-small 10.1.2
- nixpkgs-25.11-darwin 10.1.2

pkgs.qemu-utils

Generic and open source machine emulator and virtualizer

nixos-unstable 10.2.0
- nixpkgs-unstable 10.2.0
- nixos-unstable-small 10.2.0
nixos-25.11 10.1.2
- nixos-25.11-small 10.1.2
- nixpkgs-25.11-darwin 10.1.2

pkgs.canokey-qemu

CanoKey QEMU Virt Card

pkgs.ubootQemuX86

Boot loader for embedded systems

nixos-unstable x86_defconfig-2025.10
- nixpkgs-unstable x86_defconfig-2025.10
- nixos-unstable-small x86_defconfig-2025.10
nixos-25.11 x86_defconfig-2025.10
- nixos-25.11-small x86_defconfig-2025.10
- nixpkgs-25.11-darwin x86_defconfig-2025.10

pkgs.ubootQemuX86_64

Boot loader for embedded systems

nixos-unstable x86_64_defconfig-2025.10
- nixpkgs-unstable x86_64_defconfig-2025.10
- nixos-unstable-small x86_64_defconfig-2025.10
nixos-25.11 x86_64_defconfig-2025.10
- nixos-25.11-small x86_64_defconfig-2025.10
- nixpkgs-25.11-darwin x86_64_defconfig-2025.10

pkgs.ubootQemuAarch64

Boot loader for embedded systems

nixos-unstable qemu_arm64_defconfig-2025.10
- nixpkgs-unstable qemu_arm64_defconfig-2025.10
- nixos-unstable-small qemu_arm64_defconfig-2025.10
nixos-25.11 qemu_arm64_defconfig-2025.10
- nixos-25.11-small qemu_arm64_defconfig-2025.10
- nixpkgs-25.11-darwin qemu_arm64_defconfig-2025.10

pkgs.qemu-python-utils

Python tooling used by the QEMU project to build, configure, and test QEMU

nixos-unstable 0.6.1.0a1
- nixpkgs-unstable 0.6.1.0a1
- nixos-unstable-small 0.6.1.0a1
nixos-25.11 0.6.1.0a1
- nixos-25.11-small 0.6.1.0a1
- nixpkgs-25.11-darwin 0.6.1.0a1

pkgs.armTrustedFirmwareQemu

Reference implementation of secure world software for ARMv8-A

nixos-unstable 2.13.0
- nixpkgs-unstable 2.13.0
- nixos-unstable-small 2.13.0
nixos-25.11 2.13.0
- nixos-25.11-small 2.13.0
- nixpkgs-25.11-darwin 2.13.0

pkgs.python312Packages.qemu

Python tooling used by the QEMU project to build, configure, and test QEMU

nixos-25.11 0.6.1.0a1
- nixos-25.11-small 0.6.1.0a1
- nixpkgs-25.11-darwin 0.6.1.0a1

pkgs.python313Packages.qemu

Python tooling used by the QEMU project to build, configure, and test QEMU

nixos-unstable 0.6.1.0a1
- nixpkgs-unstable 0.6.1.0a1
- nixos-unstable-small 0.6.1.0a1
nixos-25.11 0.6.1.0a1
- nixos-25.11-small 0.6.1.0a1
- nixpkgs-25.11-darwin 0.6.1.0a1

pkgs.python314Packages.qemu

Python tooling used by the QEMU project to build, configure, and test QEMU

nixos-unstable 0.6.1.0a1
- nixpkgs-unstable 0.6.1.0a1
- nixos-unstable-small 0.6.1.0a1

pkgs.python312Packages.qemu-qmp

Asyncio library for communicating with QEMU Monitor Protocol (“QMP”) servers

nixos-25.11 0.0.5
- nixos-25.11-small 0.0.5
- nixpkgs-25.11-darwin 0.0.5

pkgs.python313Packages.qemu-qmp

Asyncio library for communicating with QEMU Monitor Protocol (“QMP”) servers

nixos-unstable 0.0.5
- nixpkgs-unstable 0.0.5
- nixos-unstable-small 0.0.5
nixos-25.11 0.0.5
- nixos-25.11-small 0.0.5
- nixpkgs-25.11-darwin 0.0.5

pkgs.python314Packages.qemu-qmp

Asyncio library for communicating with QEMU Monitor Protocol (“QMP”) servers

nixos-unstable 0.0.5
- nixpkgs-unstable 0.0.5
- nixos-unstable-small 0.0.5

Package maintainers

@lopsided98 Ben Wolsieffer <benwolsieffer@gmail.com>
@oxalica oxalica <oxalicc@pm.me>
@DavHau David Hauer <d.hauer.it@gmail.com>
@devplayer0 Jack O'Sullivan <dev@nul.ie>
@alyssais Alyssa Ross <hi@alyssa.is>
@SigmaSquadron Fernando Rodrigues <alpha@sigmasquadron.net>
@CertainLach Yaroslav Bolyukin <iam@lach.pw>
@digitalrane Rane <rane+git@junkyard.systems>
@hehongbo Hongbo
@bartsch Daniel Martin <consume.noise@gmail.com>
@dezgeg Tuomas Tynkkynen <tuomas.tynkkynen@iki.fi>
@brianmcgillion Brian McGillion <bmg.avoin@gmail.com>