CVE-2017-15118: Buffer Overflow
First published: Thu Nov 23 2017(Updated: )
A stack-based buffer overflow vulnerability was found in NBD server implementation in qemu allowing client to request an export name of size up to 4096 bytes, which in fact should be limited to 256 bytes, allowing to cause out-of-bounds stack write in qemu process. If NBD server requires TLS, the attacker cannot trigger the buffer overflow without first successfully negotiating TLS. Upstream patch: --------------- -> <a href="https://lists.gnu.org/archive/html/qemu-devel/2017-11/msg05045.html">https://lists.gnu.org/archive/html/qemu-devel/2017-11/msg05045.html</a> Reference: ---------- -> <a href="http://www.openwall.com/lists/oss-security/2017/11/28/8">http://www.openwall.com/lists/oss-security/2017/11/28/8</a>
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| QEMU qemu | <2.11 | |
| Canonical Ubuntu Linux | =14.04 | |
| Canonical Ubuntu Linux | =16.04 | |
| Canonical Ubuntu Linux | =17.10 | |
| Redhat Enterprise Linux | =7.0 | |
| redhat/qemu | <2.11 | 2.11 |
| debian/qemu | 1:5.2+dfsg-11+deb11u3 1:5.2+dfsg-11+deb11u2 1:7.2+dfsg-7+deb12u7 1:9.2.0+ds-2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2017/11/28/8
- http://www.securityfocus.com/bid/101975
- https://access.redhat.com/errata/RHSA-2018:1104
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15118
- https://lists.gnu.org/archive/html/qemu-devel/2017-11/msg05045.html
- https://usn.ubuntu.com/3575-1/
- https://www.exploit-db.com/exploits/43194/
- https://launchpad.net/bugs/cve/CVE-2017-15118
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1358264&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=1358264&action=edit
- https://git.qemu.org/?p=qemu.git;a=commit;h=f37708f6b8
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1518236
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1518235
- https://bugzilla.redhat.com/show_bug.cgi?id=1516922
- https://security-tracker.debian.org/tracker/CVE-2017-15118
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15118
- https://nvd.nist.gov/vuln/detail/CVE-2017-15118
- https://ubuntu.com/security/CVE-2017-15118
- collector/nvd-index
- agent/type
- agent/first-publish-date
- collector/launchpad-cve
- source/Launchpad
- agent/author
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2017-15118
- agent/software-canonical-lookup
- agent/weakness
- collector/mitre-cve
- source/MITRE
- agent/severity
- collector/usn-cve
- source/Ubuntu
- agent/remedy
- agent/references
- agent/tags
- agent/description
- agent/event
- collector/nvd-cve
- source/NVD
- agent/last-modified-date
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- agent/trending
- vendor/qemu
- canonical/qemu qemu
- vendor/canonical
- canonical/canonical ubuntu linux
- version/canonical ubuntu linux/14.04
- version/canonical ubuntu linux/16.04
- version/canonical ubuntu linux/17.10
- vendor/redhat
- canonical/redhat enterprise linux
- version/redhat enterprise linux/7.0
- package-manager/redhat
- package-manager/debian