CVE-2018-18438: Integer Overflow
Published Oct 19, 2018
·Updated
Qemu has integer overflows because IOReadHandler and its associated functions use a signed integer data type for a size value.
Affected Software
9 affected componentsFixes available
debian/qemu
1:3.1+dfsg-8+deb10u81:3.1+dfsg-8+deb10u111:5.2+dfsg-11+deb11u31:5.2+dfsg-11+deb11u21:7.2+dfsg-7+deb12u31:8.1.2+ds-11:8.2.0+ds-1
Qemu Qemu
redhat Enterprise Linux=6.0
redhat Enterprise Linux=7.0
redhat Openstack=8
redhat Openstack=9
redhat Openstack=10
redhat Openstack=12
redhat Openstack=13
Remediation
Event History
Oct 19, 2018
CVE Published
via MITRE·10:00 PM
Data Sourced
via MITRE·10:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2018-18438?
CVE-2018-18438 has a moderate severity rating due to potential integer overflow vulnerabilities in QEMU.
2
How do I fix CVE-2018-18438?
To fix CVE-2018-18438, upgrade to a patched version of QEMU as specified by your operating system vendor.
3
What software is affected by CVE-2018-18438?
CVE-2018-18438 affects multiple versions of QEMU and various Red Hat and OpenStack products.
4
What are the potential impacts of CVE-2018-18438?
The potential impacts of CVE-2018-18438 include application crashes and possible remote code execution due to the integer overflow.
5
Is there a workaround for CVE-2018-18438 until I can apply a fix?
Currently, the most effective workaround for CVE-2018-18438 is to disable the affected features of QEMU until a fix can be applied.