CVE-2017-11334: Medium severity Qemu Qemu vulnerability
Last updated 24 July 2024
Other sources
Qemu emulator built to use 'qemumapramptr' to access guests' ram block area is vulnerable to a OOB r/w access issue. It could occur during a DMA operation.
A privileged user inside guest could use this flaw to crash the guest instance resulting in DoS.
Upstream patch: --------------- -> https://git.qemu.org/?p=qemu.git;a=commitdiff;h=04bf2526ce87f21b32c9acba1c5518708c243ad0
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2017/07/17/4
— Red Hat
The addressspacewritecontinue function in exec.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (out-of-bounds access and guest instance crash) by leveraging use of qemumapramptr to access guest ram block area.
— Launchpad
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-11334?
CVE-2017-11334 is considered a medium severity vulnerability that can result in a denial of service (DoS).
How do I fix CVE-2017-11334?
To resolve CVE-2017-11334, update QEMU to a version that is patched against this vulnerability.
Who is affected by CVE-2017-11334?
CVE-2017-11334 affects users running QEMU versions up to 2.9.1, particularly those using the Debian 9.0 operating system.
What type of vulnerability is CVE-2017-11334?
CVE-2017-11334 is an out-of-bounds read/write access issue that arises during DMA operations.
Can CVE-2017-11334 be exploited by a non-privileged user?
No, CVE-2017-11334 requires a privileged user inside the guest to exploit the vulnerability.