CVE-2017-9330: Medium severity Qemu Qemu vulnerability
Last updated 24 July 2024
Other sources
QEMU (aka Quick Emulator) before 2.9.0, when built with the USB OHCI Emulation support, allows local guest OS users to cause a denial of service (infinite loop) by leveraging an incorrect return value, a different vulnerability than CVE-2017-6505.
— Launchpad
Quick Emulator built with the USB OHCI Emulation support is vulnerable to an infinite loop issue. It could occur while processing an endpoint list descriptor in ohciserviceedlist().
A guest user/process could use this flaw to crash Qemu process resulting in DoS.
Upstream patch: --------------- -> http://git.qemu.org/?p=qemu.git;a=commitdiff;h=26f670a244982335cc08943fb1ec099a2c81e42d
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2017/06/01/3
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2017-9330?
CVE-2017-9330 is a vulnerability in QEMU (Quick Emulator), a virtualization software, that allows local guest OS users to cause a denial of service by exploiting an incorrect return value in the USB OHCI Emulation support.
How severe is CVE-2017-9330?
CVE-2017-9330 has a low severity rating.
Which software versions are affected by CVE-2017-9330?
QEMU versions before 2.9.0 when built with USB OHCI Emulation support are affected by CVE-2017-9330.
How do I fix CVE-2017-9330?
To fix CVE-2017-9330, update QEMU to version 2.9.0 or later.
Where can I find more information about CVE-2017-9330?
You can find more information about CVE-2017-9330 at the following references: [1] http://www.openwall.com/lists/oss-security/2017/06/01/3 [2] http://git.qemu.org/?p=qemu.git;a=commit;h=26f670a244982335cc08943fb1ec099a2c81e42d [3] https://bugzilla.redhat.com/show_bug.cgi?id=1457697