CVE-2018-12617

qmp_guest_file_read en qga/commands-posix.c y qga/commands-win32.c en qemu-ga (también conocido como QEMU Guest Agent) en QEMU 2.12.50 tiene un desbordamiento de enteros que provoca que una llamada g_malloc0() desencadene un fallo de segmentación al intentar asignar un gran fragmento de memoria. La vulnerabilidad puede ser explotada mediante el envío de un comando QMP manipulado (incluyendo guest-file-read con un valor largo de conteo) al agente mediante el socket en escucha.

Daniel Shapira and Arash Tohidi discovered that QEMU incorrectly handled NE2000 device emulation. An attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. It was discovered that QEMU incorrectly handled the Slirp networking back-end. A privileged attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service, or possibly execute arbitrary code on the host. In the default installation, when QEMU is used with libvirt, attackers would be isolated by the libvirt AppArmor profile. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu 18.04 LTS. Various other issues were also addressed.