This file contains ambiguous Unicode characters that may be confused with others in your current locale. If your use case is intentional and legitimate, you can safely ignore this warning. Use the Escape button to highlight these characters.
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE glsa SYSTEM "http://www.gentoo.org/dtd/glsa.dtd">
<glsaid="201711-11">
<title>VDE: Privilege escalation</title>
<synopsis>A vulnerability was discovered in VDE which may allow local users
to gain root privileges.
</synopsis>
<producttype="ebuild">vde</product>
<announced>2017-11-12</announced>
<revisedcount="1">2017-11-12</revised>
<bug>603382</bug>
<access>local</access>
<affected>
<packagename="net-misc/vde"auto="yes"arch="*">
<unaffectedrange="ge">2.3.2-r4</unaffected>
<vulnerablerange="lt">2.3.2-r4</vulnerable>
</package>
</affected>
<background>
<p>VDE is an ethernet compliant virtual network that can be spawned over a
set of physical computer over the Internet.
</p>
</background>
<description>
<p>It was discovered that Gentoo’s default VDE installation suffered from
a privilege escalation vulnerability in the init script. This script
calls an unsafe ‘chown’ command which gives members from “qemu”
group root privileges.
</p>
</description>
<impacttype="normal">
<p>A local attacker could escalate privileges to root.</p>
</impact>
<workaround>
<p>There is no known workaround at this time.</p>
</workaround>
<resolution>
<p>All VDE users should upgrade to the latest version:</p>