Out-of-bounds read in QEMU - CVE-2017-5667
Published: March 16, 2017 / Updated: July 28, 2020
Vulnerability identifier: #VU32091
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-5667
CWE-ID: CWE-125
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local authenticated user to a crash the entire system.
The sdhci_sdma_transfer_multi_blocks function in hw/sd/sdhci.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (out-of-bounds heap access and crash) or execute arbitrary code on the QEMU host via vectors involving the data transfer length.
Affected software
QEMU
Gentoo Linux
qemu (Alpine package)
Gentoo Linux
qemu (Alpine package)
How to mitigate CVE-2017-5667
Install update from vendor's website.
qemu (Alpine package) - addressed in versions 2.8.1-r1, 2.8.1.1-r0
External References
- http://git.qemu-project.org/?p=qemu.git;a=commitdiff;h=42922105beb14c2fc58185ea022b9f72fb5465e9
- http://www.openwall.com/lists/oss-security/2017/01/30/2
- http://www.openwall.com/lists/oss-security/2017/01/31/10
- http://www.openwall.com/lists/oss-security/2017/02/12/1
- http://www.securityfocus.com/bid/95885
- https://bugzilla.redhat.com/show_bug.cgi?id=1417559
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://security.gentoo.org/glsa/201702-28