Integer overflow in QEMU - CVE-2018-17958

Vulnerability identifier: #VU16554

CSH Severity: Low

CVSS v4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-17958

CWE-ID: CWE-190

Exploitation vector: Adjecent network

Exploit availability: No public exploit available

The vulnerability allows an adjacent attacker to cause DoS condition on the target system.

The vulnerability exists due to a boundary error in rtl8139_do_receive in hw/net/rtl8139.c because an incorrect integer data type is used. An adjacent attacker can trigger integer overflow and cause the service to crash.

QEMU
Red Hat Virtualization Manager
Red Hat Virtualization
Red Hat Virtualization for IBM Power LE
Red Hat OpenStack
Red Hat OpenStack for IBM Power
Opensuse
Fedora
qemu-kvm-rhev (Red Hat package)
qemu

Install update from vendor's website.

qemu-kvm-rhev (Red Hat package) - update to 2.12.0-33.el7
qemu - update to 3.0.0-2.fc29

• https://lists.gnu.org/archive/html/qemu-devel/2018-09/msg03269.html

• OpenSUSE Linux update for qemu
• OpenSUSE Linux update for qemu
• Red Hat update for qemu-kvm-rhev
• Red Hat Virtualization 4 for Red Hat Enterprise Linux 7 and Red Hat Virtualization Engine 4.3 update for qemu-kvm-rhev
• Fedora 29 update for qemu