Memory leak in QEMU - CVE-2017-15268

Vulnerability identifier: #VU12163

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-15268

CWE-ID: CWE-401

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause DoІ condition on the target system.

The weakness exists in io/channel-websock.c due to memory leak in slow data-channel read operations. A remote attacker can trigger memory corruption and cause the service to crash.

QEMU
Debian Linux
Amazon Linux AMI
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux for Scientific Computing
Fedora
Red Hat Virtualization
Red Hat Virtualization for IBM Power LE
qemu

Update to version 2.10.1.

qemu - update to 2.10.1-1.fc27

• https://lists.gnu.org/archive/html/qemu-devel/2017-10/msg02278.html

• Denial of service in QEMU
• Debian update for qemu
• Amazon Linux AMI update for qemu-kvm
• Red Hat update for qemu-kvm-rhev
• Red Hat update for qemu-kvm
• Fedora 27 update for qemu