Buffer overflow in QEMU - CVE-2018-20815

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU19189

Buffer overflow in QEMU - CVE-2018-20815

Published: July 16, 2019 / Updated: July 18, 2019


Vulnerability identifier: #VU19189
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-20815
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in the deprecated "load_image" function, as defined in the "device_tree.c" file. A remote attacker can submit a large image file to the affected system, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.


Affected software

QEMU
Red Hat Virtualization Manager
Gentoo Linux
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power
Opensuse
Fedora
qemu (Debian package)
qemu-kvm-rhev (Red Hat package)
qemu
Red Hat Virtualization for IBM Power LE
Red Hat Virtualization
Red Hat OpenStack
Red Hat OpenStack for IBM Power

How to mitigate CVE-2018-20815

Install update from vendor's website.

QEMU - update to 4.0.0
qemu (Debian package) - update to 1:2.8+dfsg-6+deb9u8
qemu-kvm-rhev (Red Hat package) - update to 2.12.0-33.el7
qemu - addressed in versions 3.0.1-4.fc29, 3.1.0-9.fc30

External References

Related Security Bulletins