CVE-2017-16845: Input Validation
Published Nov 17, 2017
·Updated
hw/input/ps2.c in Qemu does not validate 'rptr' and 'count' values during guest migration, leading to out-of-bounds access.
Affected Software
9 affected componentsFixes available
debian/qemu<=1:2.1+dfsg-11, <=1:2.10.0+dfsg-2
Qemu Qemu<=2.11.2
Debian Debian Linux=8.0
Debian Debian Linux=9.0
Canonical Ubuntu Linux=14.04
Canonical Ubuntu Linux=16.04
Canonical Ubuntu Linux=17.10
Canonical Ubuntu Linux=18.04
debian/qemu
1:5.2+dfsg-11+deb11u31:5.2+dfsg-11+deb11u51:7.2+dfsg-7+deb12u181:7.2+dfsg-7+deb12u151:10.0.11+ds-0+deb13u11:10.0.2+ds-2+deb13u11:11.0.2+ds-2
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/qemuto a version that resolves this vulnerability.Fixed in 1:5.2+dfsg-11+deb11u3Fixed in 1:5.2+dfsg-11+deb11u5Fixed in 1:7.2+dfsg-7+deb12u18Fixed in 1:7.2+dfsg-7+deb12u15Fixed in 1:10.0.11+ds-0+deb13u1Fixed in 1:10.0.2+ds-2+deb13u1Fixed in 1:11.0.2+ds-2
Event History
Nov 17, 2017
CVE Published
via MITRE·08:00 PM
Data Sourced
via MITRE·08:00 PM
Description
Data Sourced
via NVD·08:29 PM
RemedyDescriptionSeverityWeaknessAffected Software
Jan 11, 2024
Data Sourced
via Launchpad·10:32 PM
Description
Feb 19, 2026
Data Sourced
via Ubuntu·08:14 PM
RemedyDescriptionSeverityAffected Software
Jul 16, 2026
Data Sourced
via Debian·11:14 AM
DescriptionAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2017-16845?
CVE-2017-16845 is classified as a high severity vulnerability due to potential out-of-bounds access during guest migration.
2
How do I fix CVE-2017-16845?
To fix CVE-2017-16845, upgrade QEMU to versions 1:5.2+dfsg-11+deb11u3 or later.
3
Which software versions are affected by CVE-2017-16845?
CVE-2017-16845 affects QEMU versions up to and including 2.11.2.
4
Where can I find more details about CVE-2017-16845?
More details about CVE-2017-16845 can be found in security advisories related to QEMU.
5
Is CVE-2017-16845 relevant to Debian or Ubuntu users?
Yes, CVE-2017-16845 is particularly relevant to Debian and Ubuntu users running vulnerable versions of QEMU.