Out-of-bounds read in QEMU - CVE-2017-18030

Vulnerability identifier: #VU10940

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-18030

CWE-ID: CWE-125

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows an adjacent attacker to cause DoS condition on the target system.

The weakness exists in the cirrus_invalidate_region function in hw/display/cirrus_vga.c due to out-of-bounds read. A remote attacker can use vectors related to negative pitch, trigger memory error and cause QEMU process to crash.

QEMU
Gentoo Linux
SUSE Linux
Oracle VM Server for x86

Install update from vendor's website.

• https://git.qemu.org/?p=qemu.git;a=commit;h=f153b563f8cf121aebf5a2fff5f0110faf58ccb3

• SUSE Linux update for xen
• OpenSUSE Linux update for xen
• SUSE Linux update for xen
• SUSE Linux update for xen
• SUSE Linux update for xen
• SUSE Linux update for xen
• SUSE Linux update for qemu
• Gentoo update for QEMU
• SUSE Linux update for kvm
• SUSE Linux update for xen
• Multiple vulnerabilities in Oracle VM Server