CVE-2017-8379: Medium severity qemu vulnerability
Memory leak in the keyboard input event handlers support in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption) by rapidly generating large keyboard events.
Other sources
Quick Emulator(Qemu) built with the keyboard input event handlers support is vulnerable to a host memory leakage issue. It could occur if a guest user was to generate large keyboard events, faster than Qemu could process them.
A privileged user inside guest could use this flaw to exhaust host memory, resulting in DoS.
Upstream patch: --------------- -> https://lists.gnu.org/archive/html/qemu-devel/2017-04/msg05599.html
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2017/05/03/2
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-8379?
CVE-2017-8379 is considered a moderate severity vulnerability due to its potential to cause denial of service by local privileged users.
How do I fix CVE-2017-8379?
To fix CVE-2017-8379, you should update QEMU to version 2.9.2 or later, or apply patches provided by your vendor.
Who is affected by CVE-2017-8379?
CVE-2017-8379 affects users of QEMU versions up to and including 2.9.1, as well as certain versions of Debian Linux and Red Hat OpenStack.
What type of attack does CVE-2017-8379 facilitate?
CVE-2017-8379 facilitates denial of service attacks by exploiting a memory leak in the keyboard input event handlers support in QEMU.
Can CVE-2017-8379 be exploited remotely?
CVE-2017-8379 cannot be exploited remotely as it requires local privileged access to the guest OS.