PT-2017-17688 · Qemu+3 · Qemu+3

Li Qiang

·

Published

2017-04-10

·

Updated

2020-09-10

·

CVE-2017-7377

CVSS v3.1

6.0

Medium

VectorAV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions QEMU (aka Quick Emulator) versions prior to the fixed version
Description The issue allows local guest OS privileged users to cause a denial of service, specifically file descriptor or memory consumption, via certain vectors related to an already in-use fid. This is due to the v9fs create and v9fs lcreate functions in hw/9pfs/9p.c.
Recommendations For QEMU versions prior to the fixed version, consider restricting access to the v9fs create and v9fs lcreate functions as a temporary workaround until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Missing Release of Resource after Effective Lifetime

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-772

Related Identifiers

ALT-PU-2017-1521
CVE-2017-7377
DLA-1035-1
DLA-1497-1
DLA-965-1
OPENSUSE-SU-2017_1872-1
SUSE-SU-2017:1774-1
SUSE-SU-2017:2946-1
SUSE-SU-2017:2969-1
USN-3289-1

Affected Products

Alt Linux
Qemu
Suse
Ubuntu