CVE-2017-2633: Medium severity qemu vulnerability
An out-of-bounds memory access issue was found in Quick Emulator (QEMU) before 1.7.2 in the VNC display driver. This flaw could occur while refreshing the VNC display surface area in the 'vncrefreshserversurface'. A user inside a guest could use this flaw to crash the QEMU process.
Other sources
Quick Emulator(Qemu) built with the VNC display driver support is vulnerable to an out-of-bounds memory access issue. It could occur while refreshing the vnc display surface area in 'vncrefreshserversurface'.
A user/process inside guest could use this flaw to crash the Qemu process resulting in DoS.
Older versions of Qemu are affected, latest upstream releases are not.
Upstream patch: --------------- -> http://git.qemu-project.org/?p=qemu.git;a=commitdiff;h=bea60dd7679364493a0d7f5b54316c767cf894ef -> http://git.qemu-project.org/?p=qemu.git;a=commitdiff;h=9f64916da20eea67121d544698676295bbb105a7
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2017/02/23/1
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-2633?
CVE-2017-2633 is classified as a medium severity vulnerability due to its potential to crash the QEMU process.
How do I fix CVE-2017-2633?
To address CVE-2017-2633, upgrade to QEMU version 1.7.2 or later.
Who is affected by CVE-2017-2633?
CVE-2017-2633 affects users running QEMU versions prior to 1.7.2 and those using vulnerable Red Hat Enterprise Linux distributions.
What kind of attack does CVE-2017-2633 enable?
CVE-2017-2633 allows an attacker inside a guest environment to potentially crash the QEMU hypervisor.
Is CVE-2017-2633 an easy vulnerability to exploit?
Exploitation of CVE-2017-2633 requires an attacker to have access to a guest system, making it less accessible than remote vulnerabilities.