CVE-2017-2630: Buffer Overflow
First published: Fri Feb 03 2017(Updated: )
A stack buffer overflow flaw was found in the Quick Emulator (QEMU) before 2.9 built with the Network Block Device (NBD) client support. The flaw could occur while processing server's response to a 'NBD_OPT_LIST' request. A malicious NBD server could use this issue to crash a remote NBD client resulting in DoS or potentially execute arbitrary code on client host with privileges of the QEMU process.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/qemu-kvm-rhev | <10:2.9.0-14.el7 | 10:2.9.0-14.el7 |
| redhat/qemu | <2.9 | 2.9 |
| QEMU KVM | <2.9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2017/02/15/2
- http://www.securityfocus.com/bid/96265
- https://access.redhat.com/errata/RHSA-2017:2392
- https://bugzilla.redhat.com/show_bug.cgi?id=1422415
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2630
- https://github.com/qemu/qemu/commit/2563c9c6b8670400c48e562034b321a7cf3d9a85
- https://lists.gnu.org/archive/html/qemu-devel/2017-02/msg01246.html
- https://security.gentoo.org/glsa/201704-01
- https://lists.gnu.org/archive/html/qemu-devel/2017-03/msg01455.html
- https://access.redhat.com/security/cve/CVE-2017-2630
- https://www.cve.org/CVERecord?id=CVE-2017-2630 https://nvd.nist.gov/vuln/detail/CVE-2017-2630
Frequently Asked Questions
What is the severity of CVE-2017-2630?
CVE-2017-2630 is rated as a high severity vulnerability due to the potential for remote code execution.
How do I fix CVE-2017-2630?
To fix CVE-2017-2630, upgrade affected QEMU versions to 2.9 or later or apply the appropriate patches provided by your vendor.
Which software is affected by CVE-2017-2630?
CVE-2017-2630 affects QEMU packages, specifically versions prior to 2.9, including qemu-kvm-rhev on Red Hat platforms.
Can CVE-2017-2630 lead to denial of service attacks?
Yes, CVE-2017-2630 can lead to denial of service attacks by crashing the remote NBD client.
Is there a public exploit for CVE-2017-2630?
Although there are discussions of the vulnerability, as of now, no public exploit details have been widely disclosed.
- collector/redhat-cve
- agent/type
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2017-2630
- agent/software-canonical-lookup
- agent/remedy
- agent/severity
- agent/references
- agent/author
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/event
- agent/trending
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- agent/source
- package-manager/redhat
- vendor/qemu
- canonical/qemu kvm