A stack buffer overflow flaw was found in the Quick...
Vulnerability Description
A stack buffer overflow flaw was found in the Quick Emulator (QEMU) before 2.9 built with the Network Block Device (NBD) client support. The flaw could occur while processing server's response to a 'NBD_OPT_LIST' request. A malicious NBD server could use this issue to crash a remote NBD client resulting in DoS or potentially execute arbitrary code on client host with privileges of the QEMU process.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2017-2630
Credits & Attribution
No credits recorded in the NVD database.
References
- https://access.redhat.com/errata/RHSA-2017:2392
- http://www.securityfocus.com/bid/96265
- https://security.gentoo.org/glsa/201704-01
- http://www.openwall.com/lists/oss-security/2017/02/15/2
- https://lists.gnu.org/archive/html/qemu-devel/2017-02/msg01246.html
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2630
- https://bugzilla.redhat.com/show_bug.cgi?id=1422415
- https://github.com/qemu/qemu/commit/2563c9c6b8670400c48e562034b321a7cf3d9a85
More from QEMU
View All →Affected Vendor
QEMU
View all reports →