CVE-2017-8309: High severity qemu vulnerability
Memory leak in the audio/audio.c in QEMU (aka Quick Emulator) allows remote attackers to cause a denial of service (memory consumption) by repeatedly starting and stopping audio capture.
Other sources
Quick Emulator(Qemu) built with the Audio subsystem support is vulnerable to a host memory leakage issue. It could occur if a guest user was to repeatedly start and stop audio capture.
A privileged user inside guest could use this flaw to exhaust host memory, resulting in DoS.
Upstream patch: --------------- -> https://lists.gnu.org/archive/html/qemu-devel/2017-04/msg05587.html
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2017/05/03/1
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2017-8309?
CVE-2017-8309 is classified as a moderate severity vulnerability due to its potential to cause denial of service through memory consumption.
How do I fix CVE-2017-8309?
To fix CVE-2017-8309, users should upgrade to versions of QEMU higher than 2.9.1 or apply security patches provided by their distribution.
What causes CVE-2017-8309?
CVE-2017-8309 is caused by a memory leak in the audio subsystem of QEMU that occurs when starting and stopping audio capture repeatedly.
Which versions of QEMU are affected by CVE-2017-8309?
CVE-2017-8309 affects QEMU versions up to and including 2.9.1 built with audio subsystem support.
Who is primarily impacted by CVE-2017-8309?
Users running vulnerable versions of QEMU on their systems, particularly in high-load environments, are primarily impacted by CVE-2017-8309.