CVE-2017-10664: High severity Qemu Qemu vulnerability
Last updated 24 July 2024
Other sources
qemu-nbd in QEMU (aka Quick Emulator) does not ignore SIGPIPE, which allows remote attackers to cause a denial of service (daemon crash) by disconnecting during a server-to-client reply attempt.
— Launchpad
Quick Emulator(Qemu) built with the Network Block Device(NBD) Server support is vulnerable to a crash via SIGPIPE signal. It could occur if a client aborts connection due to any failure during negotiation.
A remote user/process could use this flaw to crash the qemu-nbd server resulting in DoS.
Upstream patch: --------------- -> https://lists.gnu.org/archive/html/qemu-devel/2017-06/msg02693.html
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2017/06/29/1
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2017-10664?
CVE-2017-10664 is a vulnerability in qemu-nbd in QEMU (aka Quick Emulator) that allows remote attackers to cause a denial of service (daemon crash) by disconnecting during a server-to-client reply attempt.
How severe is CVE-2017-10664?
CVE-2017-10664 has a severity level of medium.
Which software is affected by CVE-2017-10664?
QEMU versions 2.0.0+dfsg-2ubuntu1.35, 1:2.5+dfsg-5ubuntu10.15, 1:2.8+dfsg-3ubuntu2.4, 1:3.1+dfsg-8+deb10u8, 1:3.1+dfsg-8+deb10u10, 1:5.2+dfsg-11+deb11u2, 1:7.2+dfsg-7+deb12u1, 1:8.0.4+dfsg-3, and 1:8.1.0+ds-6 are affected.
How do I fix CVE-2017-10664?
To fix CVE-2017-10664, update QEMU to a version that includes the necessary patch provided by the vendor.