CVE-2017-7377: Medium severity Qemu Qemu vulnerability
Quick Emulator(Qemu) built with the virtio-9p back-end support is vulnerable to a memory leakage issue. It could occur while doing a I/O operation via v9fscreate/v9fslcreate routine.
A privileged user/process inside guest could use this flaw to leak host memory resulting in Dos.
Upstream patch: --------------- -> https://lists.gnu.org/archive/html/qemu-devel/2017-03/msg05449.html
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2017/04/03/2
Other sources
The (1) v9fscreate and (2) v9fslcreate functions in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allow local guest OS privileged users to cause a denial of service (file descriptor or memory consumption) via vectors related to an already in-use fid.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7377?
CVE-2017-7377 has a high severity due to its potential to cause denial of service by leaking host memory.
How do I fix CVE-2017-7377?
To fix CVE-2017-7377, upgrade QEMU to a version later than 2.8.1 that includes the upstream patch.
Who is affected by CVE-2017-7377?
CVE-2017-7377 affects QEMU installations with virtio-9p back-end support that are running specific vulnerable versions.
What type of vulnerability is CVE-2017-7377?
CVE-2017-7377 is a memory leakage vulnerability occurring during I/O operations in QEMU.
Can unprivileged users exploit CVE-2017-7377?
No, CVE-2017-7377 can only be exploited by a privileged user or process within the guest environment.