CVE-2018-11806: Qemu Slirp Networking Heap-based Buffer Overflow Privilege Escalation Vulnerability
A heap buffer overflow issue was found in the way Slirp networking back-end in QEMU processes fragmented packets. It could occur while reassembling the fragmented datagrams of an incoming packet.
A privileged user/process inside guest could use this flaw to crash the QEMU process resulting in DoS OR potentially leverage it to execute arbitrary code on the host with privileges of the QEMU process.
Upstream patch: --------------- -> https://lists.gnu.org/archive/html/qemu-devel/2018-06/msg01012.html
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2018/06/07/1
Other sources
mcat in slirp/mbuf.c in Qemu has a heap-based buffer overflow via incoming fragmented datagrams.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2018-11806?
The severity of CVE-2018-11806 is high (8.2).
How can an attacker exploit CVE-2018-11806?
An attacker must first obtain the ability to execute code on the guest OS in order to exploit CVE-2018-11806.
Which software is affected by CVE-2018-11806?
Qemu versions 1:2.11+dfsg-1ubuntu7.8, 2.0.0+dfsg-2ubuntu1.44, and 1:2.5+dfsg-5ubuntu10.33 are affected by CVE-2018-11806.
How do I fix CVE-2018-11806?
To fix CVE-2018-11806, update Qemu to version 1:3.1+dfsg-8+deb10u8 or later if using Debian, or version 1:2.11+dfsg-1ubuntu7.8 or later if using Ubuntu.
Where can I find more information about CVE-2018-11806?
You can find more information about CVE-2018-11806 at the following references: [1](https://lists.gnu.org/archive/html/qemu-devel/2018-06/msg01012.html), [2](http://www.openwall.com/lists/oss-security/2018/06/07/1), [3](https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1586249).