CVE-2018-20815: Buffer Overflow
A heap buffer overflow issue was found in the loaddevicetree() function of QEMU, which is invoked to load device tree blob at boot time. It occurs due to device tree size manipulation before buffer allocation, which could overflow a signed int type.
A user/process could use this flaw to potentially execute arbitrary code on a host system with privileges of the QEMU process.
Upstream patch: --------------- -> https://git.qemu.org/?p=qemu.git;a=commitdiff;h=da885fe1ee8b4589047484bd7fa05a4905b52b17 -> https://git.qemu.org/?p=qemu.git;a=commitdiff;h=065e6298a75164b4347682b63381dbe752c2b156
Reference: ---------- -> https://www.openwall.com/lists/oss-security/2019/03/27/1
Other sources
In QEMU 3.1.0, loaddevicetree in devicetree.c calls the deprecated loadimage function, which has a buffer overflow risk.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2018-20815.
What is the severity of CVE-2018-20815?
CVE-2018-20815 has a severity rating of high.
Which software versions are affected by CVE-2018-20815?
Various versions of QEMU are affected, including 1:2.11+dfsg-1ubuntu7.13, 1:2.12+dfsg-3ubuntu8.7, 1:3.1+dfsg-2ubuntu4, and more.
How can I fix CVE-2018-20815?
To fix CVE-2018-20815, update to a version of QEMU that includes the necessary security patches, such as 1:2.11+dfsg-1ubuntu7.13 or 1:2.12+dfsg-3ubuntu8.7.
Where can I find more information about CVE-2018-20815?
More information about CVE-2018-20815 can be found in the references provided, including the commitdiff links and the OSS Security mailing list.