The esp_do_dma function in hw/scsi/esp.c in QEMU (aka Quick Emulator), when built with ESP/NCR53C9x controller emulation support, allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) or execute arbitrary code on the QEMU host via vectors involving DMA read into ESP command buffer.
CVSS Details
- CVSS 3.1 Base Score: 6.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemuUpgrade qemu-kvm | Mar 31, 2017 | Jul 30, 2016 |
| Suse | — | Upgrade qemu-ipxeUpgrade xen-toolsUpgrade xen-kmp-defaultUpgrade xen-kmp-paeUpgrade qemu-hw-display-virtio-gpuUpgrade qemuUpgrade qemu-skibootUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-armUpgrade xen-doc-pdfUpgrade qemu-block-sshUpgrade qemu-audio-spiceUpgrade xen-libs-32bitUpgrade xen-develUpgrade qemu-ksmUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-block-iscsiUpgrade qemu-ui-spice-coreUpgrade qemu-block-rbdUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-ui-spice-appUpgrade qemu-langUpgrade qemu-seabiosUpgrade qemu-audio-ossUpgrade qemu-s390xUpgrade xen-tools-xendomains-wait-diskUpgrade xen-libsUpgrade qemu-chardev-spiceUpgrade qemu-guest-agentUpgrade qemu-ui-openglUpgrade qemu-hw-display-qxlUpgrade qemu-ppcUpgrade qemu-x86Upgrade xen-kmp-traceUpgrade qemu-kvmUpgrade qemu-audio-alsaUpgrade qemu-ui-cursesUpgrade qemu-microvmUpgrade xen-tools-domUUpgrade qemu-ui-gtkUpgrade qemu-audio-paUpgrade qemu-s390Upgrade qemu-chardev-baumUpgrade qemu-sgabiosUpgrade qemu-toolsUpgrade xenUpgrade qemu-hw-usb-redirectUpgrade xen-doc-htmlUpgrade qemu-block-curlUpgrade qemu-vgabios | Sep 9, 2016 | Aug 17, 2016 |
| Ubuntu | — | Upgrade qemu-system-sparcUpgrade qemu-system-armUpgrade qemu-system-x86Upgrade qemu-kvmUpgrade qemu-system-aarch64Upgrade qemu-system-miscUpgrade qemu-system-s390xUpgrade qemu-systemUpgrade qemu-system-ppcUpgrade qemu-system-mips | Jul 1, 2017 | Aug 12, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub