CVE-2017-14167: Integer Overflow
Integer overflow in the loadmultiboot function in hw/i386/multiboot.c in QEMU (aka Quick Emulator) allows local guest OS users to execute arbitrary code on the host via crafted multiboot header address values, which trigger an out-of-bounds write.
Other sources
Quick Emulator(Qemu) built with the PC System Emulator with multiboot feature support is vulnerable to an OOB r/w memory access issue. It could occur due to an integer overflow while loading a kernel image during a guest boot.
A user/process could use this flaw to potentially achieve arbitrary code execution on a host.
Upstream patch: --------------- -> https://lists.nongnu.org/archive/html/qemu-devel/2017-09/msg01483.html
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2017/09/07/2
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-14167?
CVE-2017-14167 is classified as a high severity vulnerability due to its potential to allow arbitrary code execution on the host.
How do I fix CVE-2017-14167?
To mitigate CVE-2017-14167, upgrade QEMU to the latest versions or apply the relevant patches provided by your operating system vendor.
What systems are affected by CVE-2017-14167?
CVE-2017-14167 affects multiple versions of QEMU and specific Debian Linux distributions including versions 8.0 and 9.0.
Who can exploit CVE-2017-14167?
Local guest OS users can exploit CVE-2017-14167 by crafting specific multiboot header address values.
What are the consequences of CVE-2017-14167 exploitation?
Exploitation of CVE-2017-14167 can lead to out-of-bounds writes, resulting in the remote execution of arbitrary code on the host machine.