CVE-2017-5857: Medium severity Qemu Qemu vulnerability
Memory leak in the virglcmdresourceunref function in hw/display/virtio-gpu-3d.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (host memory consumption) via a large number of VIRTIOGPUCMDRESOURCEUNREF commands sent without detaching the backing storage beforehand.
Other sources
Quick Emulator(Qemu) built with the Virtio GPU Device emulator support is vulnerable to a host memory leakage issue. It could occur while processing 'VIRTIOGPUCMDRESOURCEUNREF' command.
A guest user/process could use this flaw to leak host memory resulting in DoS.
Upstream patch: --------------- -> https://lists.nongnu.org/archive/html/qemu-devel/2017-01/msg04615.html
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2017/02/01/21
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5857?
CVE-2017-5857 has been classified as a high severity vulnerability due to potential denial of service impacts.
How do I fix CVE-2017-5857?
To fix CVE-2017-5857, upgrade to QEMU version 2.8.1.1 or later.
Who is affected by CVE-2017-5857?
Local guest OS users of QEMU versions up to 2.8.1.1 are affected by CVE-2017-5857.
What is the impact of CVE-2017-5857?
The impact of CVE-2017-5857 is a memory leak leading to excessive host memory consumption.
What type of vulnerability is CVE-2017-5857?
CVE-2017-5857 is a memory leak vulnerability found in the virgl_cmd_resource_unref function.