CVE-2014-7840: Input Validation
During migration, the values read from migration stream during ram load are not validated. Especially offset in hostfromstreamoffset() and also the length of the writes in the callers of the said function.
A user able to alter the savevm data (either on the disk or over the wire during migration) could use either of these flaws to corrupt QEMU process memory on the (destination) host, which could potentially result in arbitrary code execution on the host with the privileges of the QEMU process.
Acknowledgements:
This issue was discovered by Michael S. Tsirkin of Red Hat.
Other sources
The hostfromstreamoffset function in archinit.c in QEMU, when loading RAM during migration, allows remote attackers to execute arbitrary code via a crafted (1) offset or (2) length value in savevm data.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-7840?
CVE-2014-7840 is considered a moderate vulnerability that could lead to unauthorized memory access during the migration process.
How do I fix CVE-2014-7840?
To fix CVE-2014-7840, update your QEMU to a version higher than 2.1.3 or apply the relevant patches provided by your Linux distribution.
What attack scenarios are possible with CVE-2014-7840?
CVE-2014-7840 could allow an attacker to manipulate migration data, resulting in potential information disclosure or system compromise.
Which software is affected by CVE-2014-7840?
CVE-2014-7840 affects QEMU versions up to 2.1.3 and various builds of Red Hat Enterprise Linux, including specific versions of Enterprise Linux Desktop and Server.
Is CVE-2014-7840 exploitable over the network?
Yes, CVE-2014-7840 can be exploited over the network if the migration stream is not properly validated during the data transfer.