CVE-2019-3812: Buffer Overflow
Last updated 25 August 2025
Other sources
QEMU, through version 2.10 and through version 3.1.0, is vulnerable to an out-of-bounds read of up to 128 bytes in the hw/i2c/i2c-ddc.c:i2cddc() function. A local attacker with permission to execute i2c commands could exploit this to read stack memory of the qemu process on the host.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2019-3812?
CVE-2019-3812 has been classified with a medium severity level due to the potential for local attackers to exploit vulnerabilities in QEMU.
How do I fix CVE-2019-3812?
To fix CVE-2019-3812, update QEMU to a version later than 3.1.0 or apply the corresponding patches provided by your Linux distribution.
Who is affected by CVE-2019-3812?
CVE-2019-3812 affects QEMU versions from 2.10 to 3.1.0 across several Linux distributions including Debian, Fedora, and Ubuntu.
What can an attacker achieve by exploiting CVE-2019-3812?
Exploiting CVE-2019-3812 allows a local attacker with permission to execute i2c commands to read up to 128 bytes of stack memory from the QEMU process.
Which specific software versions are vulnerable to CVE-2019-3812?
The vulnerable versions include QEMU 2.10 up to 3.1.0 across various distributions, as well as certain packaged versions from Debian and other Linux systems.