CVE-2018-5683: Medium severity Qemu Qemu vulnerability
Last updated 25 August 2025
Other sources
Quick Emulator(QEMU) built with the VGA emulator support is vulnerable to an out-of-bounds access issue in vgadrawtext. It could occur while updating vga display area.
A privileged user inside guest could use this flaw to crash the Qemu process resulting in DoS.
Upstream patch: --------------- -> https://lists.gnu.org/archive/html/qemu-devel/2018-01/msg02131.html
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2018/01/15/2
— Red Hat
The vgadrawtext function in Qemu allows local OS guest privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) by leveraging improper memory address validation.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/qemuto a version that resolves this vulnerability.Fixed in 1:5.2+dfsg-11+deb11u3Fixed in 1:5.2+dfsg-11+deb11u5Fixed in 1:7.2+dfsg-7+deb12u18Fixed in 1:7.2+dfsg-7+deb12u15Fixed in 1:10.0.11+ds-0+deb13u1Fixed in 1:10.0.2+ds-2+deb13u1Fixed in 1:11.0.2+ds-2
Event History
Frequently Asked Questions
What is the severity of CVE-2018-5683?
CVE-2018-5683 is classified as a high severity vulnerability due to its potential to cause denial of service.
How do I fix CVE-2018-5683?
To mitigate CVE-2018-5683, upgrade to a version of QEMU that has addressed this issue, such as 1:5.2+dfsg-11+deb11u3 or higher.
Who is affected by CVE-2018-5683?
CVE-2018-5683 affects users running certain versions of QEMU, particularly those that support VGA emulator functionalities.
What kind of exploit is associated with CVE-2018-5683?
The exploit for CVE-2018-5683 involves an out-of-bounds access issue that can be triggered by a privileged user within a guest system.
What systems are vulnerable to CVE-2018-5683?
Vulnerable systems include various distributions such as Debian, Red Hat Enterprise Linux, and Ubuntu with specific versions of QEMU.