CVE-2017-6505: Medium severity Qemu Qemu vulnerability
Quick Emulator built with the USB OHCI Emulation support is vulnerable to an infinite loop issue. It could occur while processing an endpoint list descriptor in ohciserviceedlist().
A guest user/process could use this flaw to crash Qemu process resulting in DoS.
Upstream patch: --------------- -> http://git.qemu-project.org/?p=qemu.git;a=commitdiff;h=95ed56939eb2eaa4e2f349fe6dcd13ca4edfd8fb
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2017/03/06/6
Other sources
The ohciserviceedlist function in hw/usb/hcd-ohci.c in QEMU (aka Quick Emulator) before 2.9.0 allows local guest OS users to cause a denial of service (infinite loop) via vectors involving the number of link endpoint list descriptors, a different vulnerability than CVE-2017-9330.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
qemu (Quick Emulator) USB OHCI Emulation (hw/usb/hcd-ohci.c: ohci_service_ed_list)to a version that resolves this vulnerability.Fixed in 2.9.0 - Compensating control
If upgrading to a fixed QEMU version is not immediately possible, mitigate the DoS by restricting/controlling untrusted guest users/processes that can trigger the USB OHCI endpoint list processing (e.g., limit which guests/users are permitted to run with Quick Emulator USB OHCI emulation enabled).
Event History
Frequently Asked Questions
What is the severity of CVE-2017-6505?
CVE-2017-6505 has a severity rating that could lead to a denial of service (DoS) due to an infinite loop issue.
How do I fix CVE-2017-6505?
To fix CVE-2017-6505, upgrade to a version of QEMU that is above 2.8.1.1, where the vulnerability has been patched.
What component of QEMU is affected by CVE-2017-6505?
CVE-2017-6505 affects the USB OHCI Emulation support in the QEMU emulator.
What is the impact of exploiting CVE-2017-6505?
Exploiting CVE-2017-6505 may allow a guest user to crash the QEMU process, resulting in a denial of service.
In which versions of QEMU is CVE-2017-6505 found?
CVE-2017-6505 is found in QEMU versions up to and including 2.8.1.1.