Vulnetix
Try Vulnetix Request Demo
CVE-2018-12617 PUBLISHED

qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in QEMU 2.12.50 has an integer overflow causing a g_malloc0() call to trigger a segmentation fault when trying to allocate a large memory chunk. The vulnerability can be exploited by sending a crafted QMP command (including guest-file-read with a large count value) to the agent via the listening socket.

EPSS 10.99% · 93.4th percentile

Risk Scores

EPSS Score
10.99%
93.4th percentile

Affected Products

VendorProductVersions
Ubuntu:18.04:LTSqemu1:2.11+dfsg-1ubuntu7.7, 1:2.11+dfsg-1ubuntu7.6, 1:2.11+dfsg-1ubuntu7.5
Ubuntu:14.04:LTSqemu1.7.0+dfsg-3ubuntu2, 1.7.0+dfsg-3ubuntu3, 1.7.0+dfsg-3ubuntu4
Ubuntu:16.04:LTSqemu1:2.5+dfsg-5ubuntu10.1, 1:2.5+dfsg-5ubuntu10.2, 1:2.5+dfsg-5ubuntu10.3

Timeline

References

Open in Interactive Console →