Out-of-bounds read in QEMU - CVE-2017-16845
Published: March 23, 2018
Vulnerability identifier: #VU11233
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-16845
CWE-ID: CWE-125
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause DoS condition or execute arbitrary code on the target system.
The weakness exists due to out-of-bounds read. A remote attacker can cause the service to crash or execute arbitrary code.
Successful exploitation of the vulnerability may result in system compromise.
The weakness exists due to out-of-bounds read. A remote attacker can cause the service to crash or execute arbitrary code.
Successful exploitation of the vulnerability may result in system compromise.
Affected software
QEMU
Gentoo Linux
Debian Linux
SUSE Linux
Fedora
qemu
Gentoo Linux
Debian Linux
SUSE Linux
Fedora
qemu
How to mitigate CVE-2017-16845
Update to version 2.11.1 or later.
qemu - addressed in versions 2.10.2-1.fc27, 2.11.2-2.fc28