CVE-2017-5667: Medium severity Qemu Qemu vulnerability
Quick emulator(Qemu) built with the SDHCI device emulation support is vulnerable to an OOB heap access issue. It could occur while doing a multi block SDMA transfer via sdhcisdmatransfermultiblocks routine.
A privileged user inside guest could use this flaw to crash the Qemu process resulting in DoS or potentially execute arbitrary code with privileges of the Qemu process on the host.
Upstream patch: --------------- -> https://lists.gnu.org/archive/html/qemu-devel/2017-01/msg06191.html
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2017/01/30/2
Other sources
The sdhcisdmatransfermultiblocks function in hw/sd/sdhci.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (out-of-bounds heap access and crash) or execute arbitrary code on the QEMU host via vectors involving the data transfer length.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5667?
CVE-2017-5667 has been assigned a medium severity rating due to its potential to cause a denial of service.
How do I fix CVE-2017-5667?
To fix CVE-2017-5667, upgrade to QEMU version 2.8.1.2 or later.
What platforms are affected by CVE-2017-5667?
CVE-2017-5667 affects QEMU versions up to 2.8.1.1 and Debian Linux version 8.0.
Who can exploit CVE-2017-5667?
A privileged user inside the guest environment can exploit CVE-2017-5667 to crash the QEMU process.
What type of vulnerability is CVE-2017-5667?
CVE-2017-5667 is classified as an out-of-bounds heap access vulnerability.