PT-2017-4109 · Qemu+1 · Qemu+1

Jann Horn · Published 2017-02-10 · Updated 2024-08-05 · CVE-2017-8284

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions QEMU versions prior to 2.9.0

Description The issue is related to the disas insn function in target/i386/translate.c of the QEMU emulator, which does not limit the instruction size when TCG mode without hardware acceleration is used. This allows local users to gain privileges by creating a modified basic block that injects code into a setuid program. The vendor has stated that this bug does not violate any security guarantees QEMU makes.

Recommendations For QEMU versions prior to 2.9.0, update to version 2.9.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the disas insn function in target/i386/translate.c until a patch is available. Additionally, avoid using TCG mode without hardware acceleration to minimize the risk of exploitation.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

ALT-PU-2017-1521

BDU:2021-03352

CVE-2017-8284

Affected Products

Alt Linux

Qemu

References · 71

• https://github.com/qemu/qemu/commit/30663fd26c0307e414622c7a8607fbc04f92ec14 · Patch
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7718 · Security Note
• https://bdu.fstec.ru/vul/2017-01462 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5856 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9603 · Security Note
• https://bdu.fstec.ru/vul/2017-00074 · Security Note
• https://ubuntu.com/security/CVE-2017-8284 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-5525 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9908 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9060 · Security Note
• https://bdu.fstec.ru/vul/2017-00651 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2017-8284 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6058 · Security Note
• https://bdu.fstec.ru/vul/2017-00647 · Security Note
• https://bdu.fstec.ru/vul/2017-00648 · Security Note