CVE-2017-9060: Medium severity Qemu Qemu vulnerability
Last updated 24 July 2024
Other sources
Memory leak in the virtiogpusetscanout function in hw/display/virtio-gpu.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (memory consumption) via a large number of "VIRTIOGPUCMDSETSCANOUT:" commands.
— Launchpad
Quick Emulator(Qemu) built with the Virtio GPU Device emulator support is vulnerable to a memory leakage issue. It could occur while processing 'VIRTIOGPUCMDSETSCANOUT:' command.
A guest user/process could use this flaw to leak host memory resulting in Dos.
Upstream patch: --------------- -> http://git.qemu.org/?p=qemu.git;a=commitdiff;h=dd248ed7e204ee8a1873914e02b8b526e8f1b80d
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2017/05/19/1
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2017-9060?
CVE-2017-9060 is a vulnerability in QEMU (aka Quick Emulator) that allows local guest OS users to cause a denial of service (memory consumption) via a large number of "VIRTIO_GPU_CMD_SET_SCANOUT:" commands.
What is the severity of CVE-2017-9060?
CVE-2017-9060 has a severity level of low.
How can CVE-2017-9060 be exploited?
CVE-2017-9060 can be exploited by local guest OS users through the use of a large number of "VIRTIO_GPU_CMD_SET_SCANOUT:" commands.
Which software versions are affected by CVE-2017-9060?
CVE-2017-9060 affects QEMU versions 1:2.8+dfsg-3ubuntu2.4, 1:3.1+dfsg-8+deb10u8, 1:3.1+dfsg-8+deb10u10, 1:5.2+dfsg-11+deb11u2, 1:7.2+dfsg-7+deb12u1, and 1:8.1.0+ds-6.
How can I fix CVE-2017-9060?
To fix CVE-2017-9060, update your QEMU software to version 1:2.8+dfsg-3ubuntu2.4 (for Ubuntu) or use one of the remedies provided by Debian for their respective versions.