PT-2018-3401 · Qemu+3 · Qemu+3
D0Lph1N98
·
Publicado
2018-06-13
·
Atualizado
2020-11-19
·
CVE-2018-12617
CVSS v2.0
7.8
Alta
| Vetor | AV:N/AC:L/Au:N/C:N/I:N/A:C |
Name of the Vulnerable Software and Affected Versions:
QEMU versions 2.12.50
Description:
The issue is related to an integer overflow in the
qmp guest file read function, which can cause a segmentation fault when attempting to allocate a large memory chunk. This can be exploited by sending a crafted QMP command, including guest-file-read with a large count value, to the agent via the listening socket.Recommendations:
For QEMU version 2.12.50, as a temporary workaround, consider restricting access to the
qmp guest file read function until a patch is available. Avoid using the guest-file-read command with large count values in the affected QMP command until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.Exploit
Integer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Qemu
Suse
Ubuntu