CVE-2019-13164

qemu-bridge-helper.c in QEMU 3.1 and 4.0.0 does not ensure that a network interface name (obtained from bridge.conf or a --br=bridge option) is limited to the IFNAMSIZ size, which can lead to an ACL bypass.

Red Hat Virtualization Hypervisor is not affected by this vulnerability, as its bridge configuration can not take the required form.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

This flaw can only be exploited if /etc/qemu*/bridge.conf contains a line containing allow all or at least one line with a bridge name of at least 15 characters.