CVE-2017-16845: Input Validation
Published Nov 17, 2017
·Updated
hw/input/ps2.c in Qemu does not validate 'rptr' and 'count' values during guest migration, leading to out-of-bounds access.
Affected Software
9 affected componentsFixes available
debian/qemu<=1:2.1+dfsg-11, <=1:2.10.0+dfsg-2
Qemu Qemu<=2.11.2
Debian Debian Linux=8.0
Debian Debian Linux=9.0
Canonical Ubuntu Linux=14.04
Canonical Ubuntu Linux=16.04
Canonical Ubuntu Linux=17.10
Canonical Ubuntu Linux=18.04
debian/qemu
1:7.2+dfsg-7+deb12u181:7.2+dfsg-7+deb12u151:10.0.13+ds-0+deb13u11:10.0.2+ds-2+deb13u11:11.1.2+ds-31:11.1.3+ds-1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/qemuto a version that resolves this vulnerability.Fixed in 1:7.2+dfsg-7+deb12u18Fixed in 1:7.2+dfsg-7+deb12u15Fixed in 1:10.0.13+ds-0+deb13u1Fixed in 1:10.0.2+ds-2+deb13u1Fixed in 1:11.1.2+ds-3Fixed in 1:11.1.3+ds-1
Event History
Nov 17, 2017
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
Data Sourced
via NVD·08:29 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2017-16845?
CVE-2017-16845 is classified as a high severity vulnerability due to potential out-of-bounds access during guest migration.
2
How do I fix CVE-2017-16845?
To fix CVE-2017-16845, upgrade QEMU to versions 1:5.2+dfsg-11+deb11u3 or later.
3
Which software versions are affected by CVE-2017-16845?
CVE-2017-16845 affects QEMU versions up to and including 2.11.2.
4
Where can I find more details about CVE-2017-16845?
More details about CVE-2017-16845 can be found in security advisories related to QEMU.
5
Is CVE-2017-16845 relevant to Debian or Ubuntu users?
Yes, CVE-2017-16845 is particularly relevant to Debian and Ubuntu users running vulnerable versions of QEMU.