CVE-2014-0148: Medium severity qemu vulnerability
Qemu before 2.0 block driver for Hyper-V VHDX Images is vulnerable to infinite loops and other potential issues when calculating BAT entries, due to missing bounds checks for blocksize and logicalsectorsize variables. These are used to derive other fields like 'sectorsperblock' etc. A user able to alter the Qemu disk image could ise this flaw to crash the Qemu instance resulting in DoS.
Other sources
Qemu block driver for Hyper-V VHDX Images is vulnerable to infinite loops and other potential issues when calculating BAT entries, due to missing bounds checks for blocksize and logicalsectorsize variables. These are used to derive other fields like 'sectorsperblock' etc.
An user able to alter the Qemu disk image could ise this flaw to crash the Qemu instance resulting in DoS.
Upstream fix: ------------- vhdx: Bounds checking for blocksize and logicalsectorsize -> http://git.qemu.org/?p=qemu.git;a=commit;h=1d7678dec4761acdc43439da6ceda41a703ba1a6
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0148?
The severity of CVE-2014-0148 is classified as medium due to the potential for infinite loops and resource exhaustion.
How do I fix CVE-2014-0148?
To fix CVE-2014-0148, upgrade QEMU to version 2.0 or later to ensure bounds checks are properly implemented.
What software is affected by CVE-2014-0148?
CVE-2014-0148 affects QEMU versions before 2.0 and specific versions of Red Hat virtualization products.
What kind of issues does CVE-2014-0148 cause?
CVE-2014-0148 can cause infinite loops and other operational issues in virtualization environments using vulnerable QEMU versions.
Is CVE-2014-0148 a critical vulnerability?
CVE-2014-0148 is not classified as critical but still poses a significant risk to affected systems.