PT-2018-3377 · Qemu+3 · Qemu+3

Zhibin Hu · Published 2018-11-22 · Updated 2020-05-12 · CVE-2018-19489

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:L/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: QEMU (affected versions not specified)

Description: The issue is related to the use of a shared resource with incorrect synchronization during file renaming in the QEMU hardware emulator, specifically in the v9fs wstat function. This can be exploited to cause a denial of service, resulting in a crash. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

ALT-PU-2018-2870

BDU:2020-00703

CVE-2018-19489

DLA-1646-1

DSA-4454-1

DSA-4454-2

OPENSUSE-SU-2019:0254-1

OPENSUSE-SU-2019_0254-1

OPENSUSE-SU-2019_1074-1

SUSE-SU-2019:0423-1

SUSE-SU-2019:0435-1

SUSE-SU-2019:0457-1

SUSE-SU-2019:0471-1

SUSE-SU-2019:0471-2

SUSE-SU-2019:0489-1

SUSE-SU-2019:0582-1

SUSE-SU-2019:13962-1

USN-3923-1

Affected Products

Alt Linux

Qemu

Suse

Ubuntu

References · 147

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16847 · Security Note
• https://usn.ubuntu.com/3923-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DLA-1646-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:0435-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00756 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-17963 · Security Note
• https://ubuntu.com/security/CVE-2018-16872 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:13962-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2018-19489 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-3812 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20124 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20125 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2019:0423-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00704 · Security Note
• https://ubuntu.com/security/CVE-2018-20124 · Vendor Advisory