{"id":37426,"date":"2019-10-31T22:17:33","date_gmt":"2019-10-31T19:17:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/uyazvimost-pozvolyayushhaya-vyjti-iz-izolirovannogo-okruzheniya-qemu\/"},"modified":"2019-10-31T22:17:33","modified_gmt":"2019-10-31T19:17:33","slug":"uyazvimost-pozvolyayushhaya-vyjti-iz-izolirovannogo-okruzheniya-qemu","status":"publish","type":"post","link":"https:\/\/prohoster.info\/es\/blog\/news\/uyazvimost-pozvolyayushhaya-vyjti-iz-izolirovannogo-okruzheniya-qemu","title":{"rendered":"Vulnerabilidad que permite salir del entorno aislado de QEMU","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Revelados<\/a><\/noindex> detalles de la vulnerabilidad cr\u00edtica (CVE-2019-14378<\/a><\/noindex>) en el manejador SLIRP, que se utiliza por defecto en QEMU para establecer un canal de comunicaci\u00f3n entre el adaptador de red virtual en el sistema invitado y el backend de red en el lado de QEMU. El problema tambi\u00e9n afecta a los sistemas de virtualizaci\u00f3n basados en KVM (modo Usermode<\/a><\/noindex>) y Virtualbox, que utilizan el backend slirp de QEMU, as\u00ed como a las aplicaciones que aplican la pila de red en el espacio de usuario libSLIRP<\/a><\/noindex> (emulador TCP\/IP).<\/p>\n

La vulnerabilidad permite la ejecuci\u00f3n de c\u00f3digo en el lado del sistema host con los permisos del proceso manejador de QEMU al enviar desde el sistema invitado un paquete de red especialmente dise\u00f1ado y muy grande, que requiere fragmentaci\u00f3n. Debido a un error en la funci\u00f3n ip_reass(), llamada durante la reensamblaje de paquetes entrantes, el primer fragmento puede no caber en el buffer asignado y su cola ser\u00e1 escrita en las \u00e1reas de memoria siguientes al buffer. <\/p>\n

Para probar ya est\u00e1 disponible<\/a><\/noindex> Un prototipo funcional del exploit, que incluye la elusi\u00f3n de ASLR y la ejecuci\u00f3n de c\u00f3digo mediante la sobreescritura de la memoria del arreglo main_loop_tlg, que contiene la lista QEMUTimerList con manejadores que se llaman mediante un temporizador.
\nLa vulnerabilidad ya ha sido corregida en Fedora<\/a><\/noindex> y SUSE\/openSUSE<\/a><\/noindex>, pero sigue sin resolverse en Debian<\/a><\/noindex>, Arch Linux<\/a><\/noindex> y FreeBSD<\/a><\/noindex>. Hay Ubuntu<\/a><\/noindex> y RHEL<\/a><\/noindex> El problema no se manifiesta debido a la no utilizaci\u00f3n de slirp. La vulnerabilidad permanece sin corregir en la \u00faltima versi\u00f3n de libslirp 4.0<\/a><\/noindex> (la correcci\u00f3n est\u00e1 disponible actualmente como parche<\/a><\/noindex>).<\/p>\n

<\/a><\/noindex><\/p>\n

Fuente: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0434\u0435\u0442\u0430\u043b\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (CVE-2019-14378) \u0432 \u043e\u0431\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0435 SLIRP, \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0435\u043c\u043e\u043c \u0432 QEMU \u0434\u043b\u044f \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u0438 \u043a\u0430\u043d\u0430\u043b\u0430 \u0441\u0432\u044f\u0437\u0438 \u043c\u0435\u0436\u0434\u0443 \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u043c \u0441\u0435\u0442\u0435\u0432\u044b\u043c \u0430\u0434\u0430\u043f\u0442\u0435\u0440\u043e\u043c \u0432 \u0433\u043e\u0441\u0442\u0435\u0432\u043e\u0439 \u0441\u0438\u0441\u0442\u0435\u043c\u0435 \u0438 \u0441\u0435\u0442\u0435\u0432\u044b\u043c \u0431\u044d\u043a\u0435\u043d\u0434\u043e\u043c \u043d\u0430 \u0441\u0442\u043e\u0440\u043e\u043d\u0435 QEMU. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u0442\u0430\u043a\u0436\u0435 \u0437\u0430\u0442\u0440\u0430\u0433\u0438\u0432\u0430\u0435\u0442 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u0438\u0437\u0430\u0446\u0438\u0438 \u043d\u0430 \u0431\u0430\u0437\u0435 KVM (\u0432 \u0440\u0435\u0436\u0438\u043c\u0435 Usermode) \u0438 Virtualbox, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442\u0441\u044f \u0431\u044d\u043a\u0435\u043d\u0434 slirp \u0438\u0437 QEMU, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u044e\u0449\u0438\u0435 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-37426","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47 Vulnerabilidad que permite salir del entorno aislado de QEMU | ProHoster","description":"Se han divulgado los detalles de una vulnerabilidad cr\u00edtica (","canonical_url":"https:\/\/prohoster.info\/es\/blog\/news\/uyazvimost-pozvolyayushhaya-vyjti-iz-izolirovannogo-okruzheniya-qemu","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"es_ES","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u0432\u044b\u0439\u0442\u0438 \u0438\u0437 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f QEMU | ProHoster","og:description":"\u0420\u0430\u0441\u043a\u0440\u044b\u0442\u044b \u0434\u0435\u0442\u0430\u043b\u0438 \u043a\u0440\u0438\u0442\u0438\u0447\u0435\u0441\u043a\u043e\u0439 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (","og:url":"https:\/\/prohoster.info\/es\/blog\/news\/uyazvimost-pozvolyayushhaya-vyjti-iz-izolirovannogo-okruzheniya-qemu","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:17:33+00:00","article:modified_time":"2019-10-31T19:17:33+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"37426","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 17:46:20","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:27:24","updated":"2026-01-23 17:46:20","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts\/37426","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/comments?post=37426"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/posts\/37426\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/media?parent=37426"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/categories?post=37426"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/es\/wp-json\/wp\/v2\/tags?post=37426"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}