CVE-2017-7718
Qemu: display: cirrus: OOB read access issue
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
hw/display/cirrus_vga_rop.h in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors related to copying VGA data via the cirrus_bitblt_rop_fwd_transp_ and cirrus_bitblt_rop_fwd_ functions.
En el archivo hw/display/cirrus_vga_rop.h en QEMU (también se conoce como Quick Emulator), permite a los usuarios privilegiados del sistema operativo invitado local causar una denegación de servicio (lectura fuera de límites y bloqueo del proceso QEMU) por medio de vectores relacionados con el copiado de datos VGA mediante las funciones cirrus_bitblt_rop_fwd_transp_ y cirrus_bitblt__.
An out-of-bounds access issue was found in QEMU's Cirrus CLGD 54xx VGA Emulator support. The vulnerability could occur while copying VGA data using bitblt functions (for example, cirrus_bitblt_rop_fwd_transp_). A privileged user inside a guest could use this flaw to crash the QEMU process, resulting in denial of service.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2017-04-12 CVE Reserved
- 2017-04-20 CVE Published
- 2023-03-08 EPSS Updated
- 2024-08-05 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-125: Out-of-bounds Read
CAPEC
References (18)
| URL | Tag | Source |
|---|---|---|
| http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=215902d7b6fb50c6fc216fc74f770858278ed904 | X_refsource_confirm | |
| http://www.securityfocus.com/bid/97957 | Third Party Advisory | |
| https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html | Mailing List |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2017/04/19/4 | 2023-11-07 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1443441 | 2017-06-14 |
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/errata/RHSA-2017:0980 | 2023-11-07 | |
| https://access.redhat.com/errata/RHSA-2017:0981 | 2023-11-07 | |
| https://access.redhat.com/errata/RHSA-2017:0982 | 2023-11-07 | |
| https://access.redhat.com/errata/RHSA-2017:0983 | 2023-11-07 | |
| https://access.redhat.com/errata/RHSA-2017:0984 | 2023-11-07 | |
| https://access.redhat.com/errata/RHSA-2017:0988 | 2023-11-07 | |
| https://access.redhat.com/errata/RHSA-2017:1205 | 2023-11-07 | |
| https://access.redhat.com/errata/RHSA-2017:1206 | 2023-11-07 | |
| https://access.redhat.com/errata/RHSA-2017:1430 | 2023-11-07 | |
| https://access.redhat.com/errata/RHSA-2017:1431 | 2023-11-07 | |
| https://access.redhat.com/errata/RHSA-2017:1441 | 2023-11-07 | |
| https://security.gentoo.org/glsa/201706-03 | 2023-11-07 | |
| https://access.redhat.com/security/cve/CVE-2017-7718 | 2017-06-14 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Qemu Search vendor "Qemu" | Qemu Search vendor "Qemu" for product "Qemu" | <= 2.8.1.1 Search vendor "Qemu" for product "Qemu" and version " <= 2.8.1.1" | - |
Affected
| ||||||
| Qemu Search vendor "Qemu" | Qemu Search vendor "Qemu" for product "Qemu" | 2.9.0 Search vendor "Qemu" for product "Qemu" and version "2.9.0" | rc0 |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 8.0 Search vendor "Debian" for product "Debian Linux" and version "8.0" | - |
Affected
| ||||||