CVE-2017-11434: Medium severity qemu vulnerability
Last updated 24 July 2024
Other sources
Quick emulator(Qemu) built with the BOOTP/DHCP Server support is vulnerable to an OOB read issue. It could occur while parsing the DHCP options and vendor extensions options sent by a client.
A user/process could use this flaw to potentially crash the Qemu process on the host resulting in DoS.
Upstream patch: --------------- -> https://lists.gnu.org/archive/html/qemu-devel/2017-07/msg05001.html
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2017/07/19/2
— Red Hat
The dhcpdecode function in slirp/bootp.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (out-of-bounds read and QEMU process crash) via a crafted DHCP options string.
— Launchpad
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2017-11434?
CVE-2017-11434 is a vulnerability in QEMU that allows local guest OS users to cause a denial of service by triggering an out-of-bounds read and QEMU process crash.
What software is affected by CVE-2017-11434?
QEMU versions 2.0.0+dfsg-2ubuntu1.35, 1:2.5+dfsg-5ubuntu10.15, 1:2.8+dfsg-3ubuntu2.4, and 1:3.1+dfsg-8+deb10u8, 1:3.1+dfsg-8+deb10u10, 1:5.2+dfsg-11+deb11u2, 1:7.2+dfsg-7+deb12u1, and 1:8.1.0+ds-6 are affected.
What is the severity of CVE-2017-11434?
CVE-2017-11434 has a severity rating of Low.
How can I fix CVE-2017-11434?
To fix CVE-2017-11434, update QEMU to version 2.0.0+dfsg-2ubuntu1.35 or later, 1:2.5+dfsg-5ubuntu10.15 or later, 1:2.8+dfsg-3ubuntu2.4 or later, or 1:3.1+dfsg-8+deb10u8, 1:3.1+dfsg-8+deb10u10, 1:5.2+dfsg-11+deb11u2, 1:7.2+dfsg-7+deb12u1, or 1:8.1.0+ds-6.
Where can I find more details about CVE-2017-11434?
You can find more details about CVE-2017-11434 at the following references: http://www.openwall.com/lists/oss-security/2017/07/19/2, https://lists.gnu.org/archive/html/qemu-devel/2017-07/msg05001.html, and https://bugzilla.redhat.com/show_bug.cgi?id=1472611.