Use-after-free error in QEMU - CVE-2018-19364

Vulnerability identifier: #VU16557

CSH Severity: Low

CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-19364

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote authenticated attacker to cause DoS condition on the target system.

The vulnerability exists due to use-after-free condition in the VirtFS component. A remote attacker can access the system and maliciously updatу the fid path in worker threads by using the v9fs_path_copy() function while accessing files on a shared host directory, trigger memory corruption and cause the service to crash.

QEMU
Ubuntu
Opensuse
qemu-system-x86 (Ubuntu package)
qemu-system-arm (Ubuntu package)
qemu-system (Ubuntu package)
qemu-system-mips (Ubuntu package)
qemu-system-sparc (Ubuntu package)
qemu-system-misc (Ubuntu package)
qemu-system-ppc (Ubuntu package)
qemu-system-aarch64 (Ubuntu package)
qemu-system-s390x (Ubuntu package)

Install update from vendor's website.

qemu-system-x86 (Ubuntu package) - addressed in versions 2.0.0+dfsg-2ubuntu1.44, 1:2.5+dfsg-5ubuntu10.33, 1:2.11+dfsg-1ubuntu7.8, 1:2.12+dfsg-3ubuntu8.1
qemu-system-arm (Ubuntu package) - addressed in versions 2.0.0+dfsg-2ubuntu1.44, 1:2.5+dfsg-5ubuntu10.33, 1:2.11+dfsg-1ubuntu7.8, 1:2.12+dfsg-3ubuntu8.1
qemu-system (Ubuntu package) - addressed in versions 2.0.0+dfsg-2ubuntu1.44, 1:2.5+dfsg-5ubuntu10.33, 1:2.11+dfsg-1ubuntu7.8, 1:2.12+dfsg-3ubuntu8.1
qemu-system-mips (Ubuntu package) - addressed in versions 2.0.0+dfsg-2ubuntu1.44, 1:2.5+dfsg-5ubuntu10.33, 1:2.11+dfsg-1ubuntu7.8, 1:2.12+dfsg-3ubuntu8.1
qemu-system-sparc (Ubuntu package) - addressed in versions 2.0.0+dfsg-2ubuntu1.44, 1:2.5+dfsg-5ubuntu10.33, 1:2.11+dfsg-1ubuntu7.8, 1:2.12+dfsg-3ubuntu8.1
qemu-system-misc (Ubuntu package) - addressed in versions 2.0.0+dfsg-2ubuntu1.44, 1:2.5+dfsg-5ubuntu10.33, 1:2.11+dfsg-1ubuntu7.8, 1:2.12+dfsg-3ubuntu8.1
qemu-system-ppc (Ubuntu package) - addressed in versions 2.0.0+dfsg-2ubuntu1.44, 1:2.5+dfsg-5ubuntu10.33, 1:2.11+dfsg-1ubuntu7.8, 1:2.12+dfsg-3ubuntu8.1
qemu-system-aarch64 (Ubuntu package) - addressed in versions 2.0.0+dfsg-2ubuntu1.44, 1:2.5+dfsg-5ubuntu10.33
qemu-system-s390x (Ubuntu package) - addressed in versions 1:2.5+dfsg-5ubuntu10.33, 1:2.11+dfsg-1ubuntu7.8, 1:2.12+dfsg-3ubuntu8.1

• https://lists.gnu.org/archive/html/qemu-devel/2018-11/msg02795.html

• Denial of service in QEMU
• OpenSUSE Linux update for qemu
• OpenSUSE Linux update for qemu
• Ubuntu update for qemu