CVE-2019-8934
hw/ppc/spapr.c in QEMU through 3.1.0 allows Information Exposure because the hypervisor shares...
3.3 LowFix available
hw/ppc/spapr.c in QEMU through 3.1.0 allows Information Exposure because the hypervisor shares the /proc/device-tree/system-id and /proc/device-tree/model system attributes with a guest.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
0.60%Down 0.9 points since Apr 14, 2021
What each source reports
NVD Score used
hw/ppc/spapr.c in QEMU through 3.1.0 allows Information Exposure because the hypervisor shares the /proc/device-tree/system-id and /proc/device-tree/model system attributes with a guest.
- Record
CVE-2019-8934- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 2.1 Low
AV:L/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-668
- Updated
- 2026-11-02
CVE List No score
hw/ppc/spapr.c in QEMU through 3.1.0 allows Information Exposure because the hypervisor shares the /proc/device-tree/system-id and /proc/device-tree/model system attributes with a guest.
- Record
CVE-2019-8934- Updated
- 2026-11-02
EUVDEUVD-2019-18322 No score
hw/ppc/spapr.c in QEMU through 3.1.0 allows Information Exposure because the hypervisor shares the /proc/device-tree/system-id and /proc/device-tree/model system attributes with a guest.
- Record
EUVD-2019-18322- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-wcm6-f8w6-w5fj
hw/ppc/spapr.c in QEMU through 3.1.0 allows Information Exposure because the hypervisor shares...
hw/ppc/spapr.c in QEMU through 3.1.0 allows Information Exposure because the hypervisor shares the /proc/device-tree/system-id and /proc/device-tree/model system attributes with a guest.
- Record
GHSA-wcm6-f8w6-w5fj- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-668
- Updated
- 2026-11-02
OSV
hw/ppc/spapr.c in QEMU through 3.1.0 allows Information Exposure because the hypervisor shares the /proc/device-tree/system-id and /proc/device-tree/model system attributes with a guest.
- Record
CVE-2019-8934- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-8934
hw/ppc/spapr.c in QEMU through 3.1.0 allows Information Exposure because the hypervisor shares the /proc/device-tree/system-id and /proc/device-tree/model system attributes with a guest.
- Record
DEBIAN-CVE-2019-8934- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Show 6 moreShow less
OSVUBUNTU-CVE-2019-8934
hw/ppc/spapr.c in QEMU through 3.1.0 allows Information Exposure because the hypervisor shares the /proc/device-tree/system-id and /proc/device-tree/model system attributes with a guest.
- Record
UBUNTU-CVE-2019-8934- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - CVSS 3.0
- 3.3 Low
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2019:1405-1 No score
Security update for qemu
This update for qemu fixes the following issues:
Security issues fixed:
- CVE-2019-9824: Fixed an information leak in slirp (bsc#1129622)
- CVE-2019-8934: Added method to specify whether or not to expose certain ppc64 host information, which can be considered a security issue (bsc#1126455)
- CVE-2019-3812: Fixed OOB memory access and information leak in virtual monitor interface (bsc#1125721)
- CVE-2018-20815: Fix DOS possibility in device tree processing (bsc#1130675)
- Adjust fix for CVE-2019-8934 (bsc#1126455) to match the latest upstream adjustments for the same. Basically now the security fix is to provide a dummy host-model and host-serial value, which overrides getting that value from the host
- CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091: Added x86 cpu feature 'md-clear' (bsc#1111331)
Other bugs fixed:
- Use a new approach to handling the file input to -smbios option, which accepts either legacy or per-spec formats regardless of the machine type.
This update was imported from the SUSE:SLE-15:Update update project.
- Record
openSUSE-SU-2019:1405-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11287-1 No score
qemu-6.1.0-32.1 on GA media
These are all security issues fixed in the qemu-6.1.0-32.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11287-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:1238-1 No score
Security update for qemu
This update for qemu fixes the following issues:
- CVE-2019-9824: Fixed an information leak in slirp (bsc#1129622)
- CVE-2019-8934: Added method to specify whether or not to expose certain ppc64 host information, which can be considered a security issue (bsc#1126455)
- CVE-2019-3812: Fixed OOB memory access and information leak in virtual monitor interface (bsc#1125721)
- CVE-2018-20815: Fix DOS possibility in device tree processing (bsc#1130675)
- Adjust fix for CVE-2019-8934 (bsc#1126455) to match the latest upstream adjustments for the same. Basically now the security fix is to provide a dummy host-model and host-serial value, which overrides getting that value from the host
- CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091: Added x86 cpu feature 'md-clear' (bsc#1111331)
Other bugs fixed:
- Use a new approach to handling the file input to -smbios option, which accepts either legacy or per-spec formats regardless of the machine type.
- Drop the 'ampersand 0x25 shift altgr' line in pt-br keymap file (bsc#1129962)
- Record
SUSE-SU-2019:1238-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:1239-1 No score
Security update for qemu
This update for qemu fixes the following issues:
Security issues fixed:
- CVE-2019-9824: Fixed an information leak in slirp (bsc#1129622)
- CVE-2019-8934: Added method to specify whether or not to expose certain ppc64 host information, which can be considered a security issue (bsc#1126455)
- CVE-2019-3812: Fixed OOB memory access and information leak in virtual monitor interface (bsc#1125721)
- CVE-2018-20815: Fix DOS possibility in device tree processing (bsc#1130675)
- Adjust fix for CVE-2019-8934 (bsc#1126455) to match the latest upstream adjustments for the same. Basically now the security fix is to provide a dummy host-model and host-serial value, which overrides getting that value from the host
- CVE-2018-12126 CVE-2018-12127 CVE-2018-12130 CVE-2019-11091: Added x86 cpu feature 'md-clear' (bsc#1111331)
Other bugs fixed:
- Use a new approach to handling the file input to -smbios option, which accepts either legacy or per-spec formats regardless of the machine type.
- Record
SUSE-SU-2019:1239-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:1829-1 No score
Security update for qemu
This update for qemu fixes the following issues:
- Fix OOB access during mmio operations (CVE-2020-13754, bsc#1172382)
- Fix sPAPR emulator leaks the host hardware identity (CVE-2019-8934, bsc#1126455)
- Fix out-of-bounds read information disclosure in icmp6_send_echoreply (CVE-2020-10756, bsc#1172380)
- Fix out-of-bound heap buffer access via an interrupt ID field (CVE-2021-20221, bsc#1181933)
- For the record, these issues are fixed in this package already. Most are alternate references to previously mentioned issues: (CVE-2019-15890, bsc#1149813, CVE-2020-8608, bsc#1163019, CVE-2020-14364, bsc#1175534, CVE-2020-25723, bsc#1178935, CVE-2020-29130, bsc#1179477, CVE-2021-20257, bsc#1182846, CVE-2021-3419, bsc#1182975, bsc#1031692, bsc#1094725)
- Record
SUSE-SU-2021:1829-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
qemuDebian:12 |
before 1:4.1-1 | 1:4.1-1 |
qemuDebian:13 |
before 1:4.1-1 | 1:4.1-1 |
qemuDebian:14 |
before 1:4.1-1 | 1:4.1-1 |
qemuSUSE:Linux Enterprise Desktop 12 SP4 From an advisory covering 8 CVEs |
before 2.11.2-5.13.1 | 2.11.2-5.13.1 |
qemuSUSE:Linux Enterprise Server 12 SP4 From an advisory covering 8 CVEs |
before 2.11.2-5.13.1 | 2.11.2-5.13.1 |
qemuSUSE:Linux Enterprise Server for SAP Applications 12 SP4 From an advisory covering 8 CVEs |
before 2.11.2-5.13.1 | 2.11.2-5.13.1 |
qemuSUSE:Linux Enterprise Module for Basesystem 15 From an advisory covering 8 CVEs |
before 2.11.2-9.25.1 | 2.11.2-9.25.1 |
qemuSUSE:Linux Enterprise Module for Server Applications 15 From an advisory covering 8 CVEs |
before 2.11.2-9.25.1 | 2.11.2-9.25.1 |
qemuSUSE:Linux Enterprise Server 12 SP2-BCL From an advisory covering 11 CVEs |
before 2.6.2-41.65.1 | 2.6.2-41.65.1 |
qemuUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 1.5.0+dfsg-3ubuntu51.5.0+dfsg-3ubuntu61.6.0+dfsg-2ubuntu11.6.0+dfsg-2ubuntu21.6.0+dfsg-2ubuntu3 Show 45 moreShow less1.6.0+dfsg-2ubuntu41.7.0+dfsg-2ubuntu11.7.0+dfsg-2ubuntu21.7.0+dfsg-2ubuntu31.7.0+dfsg-2ubuntu41.7.0+dfsg-2ubuntu51.7.0+dfsg-2ubuntu71.7.0+dfsg-2ubuntu81.7.0+dfsg-2ubuntu91.7.0+dfsg-3ubuntu1~ppa11.7.0+dfsg-3ubuntu11.7.0+dfsg-3ubuntu21.7.0+dfsg-3ubuntu31.7.0+dfsg-3ubuntu41.7.0+dfsg-3ubuntu51.7.0+dfsg-3ubuntu61.7.0+dfsg-3ubuntu72.0.0~rc1+dfsg-0ubuntu12.0.0~rc1+dfsg-0ubuntu22.0.0~rc1+dfsg-0ubuntu32.0.0~rc1+dfsg-0ubuntu3.12.0.0+dfsg-2ubuntu12.0.0+dfsg-2ubuntu1.12.0.0+dfsg-2ubuntu1.22.0.0+dfsg-2ubuntu1.32.0.0+dfsg-2ubuntu1.52.0.0+dfsg-2ubuntu1.62.0.0+dfsg-2ubuntu1.72.0.0+dfsg-2ubuntu1.82.0.0+dfsg-2ubuntu1.92.0.0+dfsg-2ubuntu1.102.0.0+dfsg-2ubuntu1.112.0.0+dfsg-2ubuntu1.132.0.0+dfsg-2ubuntu1.142.0.0+dfsg-2ubuntu1.152.0.0+dfsg-2ubuntu1.162.0.0+dfsg-2ubuntu1.172.0.0+dfsg-2ubuntu1.182.0.0+dfsg-2ubuntu1.192.0.0+dfsg-2ubuntu1.202.0.0+dfsg-2ubuntu1.212.0.0+dfsg-2ubuntu1.222.0.0+dfsg-2ubuntu1.242.0.0+dfsg-2ubuntu1.252.0.0+dfsg-2ubuntu1.26 |
None known |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
qemuUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1:2.3+dfsg-5ubuntu91:2.3+dfsg-5ubuntu101:2.4+dfsg-4ubuntu11:2.4+dfsg-4ubuntu21:2.4+dfsg-4ubuntu3 Show 45 moreShow less1:2.4+dfsg-5ubuntu31:2.5+dfsg-1ubuntu21:2.5+dfsg-1ubuntu31:2.5+dfsg-1ubuntu41:2.5+dfsg-1ubuntu51:2.5+dfsg-5ubuntu11:2.5+dfsg-5ubuntu21:2.5+dfsg-5ubuntu41:2.5+dfsg-5ubuntu61:2.5+dfsg-5ubuntu71:2.5+dfsg-5ubuntu101:2.5+dfsg-5ubuntu10.11:2.5+dfsg-5ubuntu10.21:2.5+dfsg-5ubuntu10.31:2.5+dfsg-5ubuntu10.41:2.5+dfsg-5ubuntu10.51:2.5+dfsg-5ubuntu10.61:2.5+dfsg-5ubuntu10.71:2.5+dfsg-5ubuntu10.81:2.5+dfsg-5ubuntu10.91:2.5+dfsg-5ubuntu10.101:2.5+dfsg-5ubuntu10.111:2.5+dfsg-5ubuntu10.131:2.5+dfsg-5ubuntu10.141:2.5+dfsg-5ubuntu10.151:2.5+dfsg-5ubuntu10.161:2.5+dfsg-5ubuntu10.201:2.5+dfsg-5ubuntu10.211:2.5+dfsg-5ubuntu10.221:2.5+dfsg-5ubuntu10.241:2.5+dfsg-5ubuntu10.251:2.5+dfsg-5ubuntu10.261:2.5+dfsg-5ubuntu10.281:2.5+dfsg-5ubuntu10.291:2.5+dfsg-5ubuntu10.301:2.5+dfsg-5ubuntu10.311:2.5+dfsg-5ubuntu10.321:2.5+dfsg-5ubuntu10.331:2.5+dfsg-5ubuntu10.341:2.5+dfsg-5ubuntu10.351:2.5+dfsg-5ubuntu10.361:2.5+dfsg-5ubuntu10.371:2.5+dfsg-5ubuntu10.381:2.5+dfsg-5ubuntu10.391:2.5+dfsg-5ubuntu10.40 |
None known |
qemuUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1:2.10+dfsg-0ubuntu31:2.10+dfsg-0ubuntu41:2.10+dfsg-0ubuntu51:2.11+dfsg-1ubuntu11:2.11+dfsg-1ubuntu2 Show 45 moreShow less1:2.11+dfsg-1ubuntu41:2.11+dfsg-1ubuntu51:2.11+dfsg-1ubuntu61:2.11+dfsg-1ubuntu71:2.11+dfsg-1ubuntu7.11:2.11+dfsg-1ubuntu7.21:2.11+dfsg-1ubuntu7.31:2.11+dfsg-1ubuntu7.41:2.11+dfsg-1ubuntu7.51:2.11+dfsg-1ubuntu7.61:2.11+dfsg-1ubuntu7.71:2.11+dfsg-1ubuntu7.81:2.11+dfsg-1ubuntu7.91:2.11+dfsg-1ubuntu7.101:2.11+dfsg-1ubuntu7.121:2.11+dfsg-1ubuntu7.131:2.11+dfsg-1ubuntu7.141:2.11+dfsg-1ubuntu7.151:2.11+dfsg-1ubuntu7.171:2.11+dfsg-1ubuntu7.181:2.11+dfsg-1ubuntu7.191:2.11+dfsg-1ubuntu7.201:2.11+dfsg-1ubuntu7.211:2.11+dfsg-1ubuntu7.221:2.11+dfsg-1ubuntu7.231:2.11+dfsg-1ubuntu7.251:2.11+dfsg-1ubuntu7.261:2.11+dfsg-1ubuntu7.271:2.11+dfsg-1ubuntu7.281:2.11+dfsg-1ubuntu7.291:2.11+dfsg-1ubuntu7.311:2.11+dfsg-1ubuntu7.321:2.11+dfsg-1ubuntu7.331:2.11+dfsg-1ubuntu7.341:2.11+dfsg-1ubuntu7.351:2.11+dfsg-1ubuntu7.361:2.11+dfsg-1ubuntu7.371:2.11+dfsg-1ubuntu7.381:2.11+dfsg-1ubuntu7.391:2.11+dfsg-1ubuntu7.401:2.11+dfsg-1ubuntu7.411:2.11+dfsg-1ubuntu7.421:2.11+dfsg-1ubuntu7.42+esm11:2.11+dfsg-1ubuntu7.42+esm21:2.11+dfsg-1ubuntu7.42+esm5 |
None known |
qemuopenSUSE:Leap 15.0 From an advisory covering 8 CVEs |
before 2.11.2-lp150.7.22.1 | 2.11.2-lp150.7.22.1 |
qemuopenSUSE:Tumbleweed From an advisory covering 135 CVEs |
before 6.1.0-32.1 | 6.1.0-32.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-8934 is a low vulnerability (CVSS 3.3) in Qemu, published March 17, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.60%, the 48th percentile. Fixed in qemu 1:4.1-1.
References
openwall.com/lists/oss-security/2019/02/21/1
securityfocus.com/bid/107115
lists.gnu.org/archive/html/qemu-devel/2019-02/msg04821.html
security.netapp.com/advisory/ntap-20190411-0006
lists.opensuse.org/opensuse-security-announce/2019-04/msg00094.html
Show 169 moreShow less
nvd.nist.gov/vuln/detail/CVE-2019-8934
github.com/advisories/GHSA-wcm6-f8w6-w5fj
security-tracker.debian.org/tracker/CVE-2019-8934
suse.com/support/update/announcement/2019/suse-su-20191238-1
bugzilla.suse.com/1111331
ubuntu.com/security/CVE-2019-8934
cve.org/CVERecord?id=CVE-2019-8934
This page doesn't list everything
Left out here: 40 versions. The JSON record has them.