CVE-2017-17381: Divide by Zero
Last updated 25 August 2025
Other sources
The Virtio Vring implementation in QEMU allows local OS guest users to cause a denial of service (divide-by-zero error and QEMU process crash) by unsetting vring alignment while updating Virtio rings.
— Launchpad
Virtio Vring implementation in Quick Emulator(QEMU) is vulnerable to an arithmetic exception issue. It could occur if a guest was to unset vring alignment while updating Virtio rings.
A guest user/process could use this flaw to crash Qemu process resulting in DoS.
Upstream patch: --------------- -> https://lists.gnu.org/archive/html/qemu-devel/2017-12/msg00166.html
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/qemuto a version that resolves this vulnerability.Fixed in 1:7.2+dfsg-7+deb12u18Fixed in 1:7.2+dfsg-7+deb12u15Fixed in 1:10.0.13+ds-0+deb13u1Fixed in 1:10.0.2+ds-2+deb13u1Fixed in 1:11.1.2+ds-3
Event History
Frequently Asked Questions
What is the severity of CVE-2017-17381?
CVE-2017-17381 has a severity rating that may lead to a denial of service by crashing the QEMU process.
How do I fix CVE-2017-17381?
To fix CVE-2017-17381, upgrade to a version of QEMU that is patched against this vulnerability.
What is the impact of CVE-2017-17381 on users?
The impact of CVE-2017-17381 allows local OS guest users to crash the QEMU process, leading to a denial of service.
Which software versions are affected by CVE-2017-17381?
Affected software versions include QEMU versions prior to 2.10.3 and specific Debian packages as noted.
Is CVE-2017-17381 exploitable remotely?
CVE-2017-17381 is not exploitable remotely as it requires local OS guest user access to trigger the vulnerability.