The esp_do_dma function in hw/scsi/esp.c in QEMU (aka Quick Emulator), when built with ESP/NCR53C9x controller emulation support, allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) or execute arbitrary code on the QEMU host via vectors involving DMA read into ESP command buffer.
CVSS Details
- CVSS 3.1 Base Score: 6.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemuUpgrade qemu-kvm | Mar 31, 2017 | Jul 30, 2016 |
| Suse | — | Upgrade qemu-hw-display-virtio-vgaUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-langUpgrade qemu-seabiosUpgrade qemu-s390xUpgrade qemu-ui-spice-coreUpgrade xen-kmp-paeUpgrade qemu-block-iscsiUpgrade xen-develUpgrade qemu-block-sshUpgrade qemu-block-rbdUpgrade xen-doc-pdfUpgrade xen-tools-xendomains-wait-diskUpgrade qemu-audio-spiceUpgrade xen-toolsUpgrade qemu-skibootUpgrade qemu-ui-openglUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-guest-agentUpgrade qemu-ipxeUpgrade qemu-ksmUpgrade xen-libsUpgrade xen-kmp-defaultUpgrade qemu-audio-ossUpgrade qemuUpgrade qemu-ui-spice-appUpgrade xen-libs-32bitUpgrade qemu-hw-display-qxlUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-armUpgrade qemu-chardev-spiceUpgrade qemu-sgabiosUpgrade qemu-block-curlUpgrade qemu-chardev-baumUpgrade xenUpgrade qemu-audio-paUpgrade qemu-s390Upgrade xen-tools-domUUpgrade xen-kmp-traceUpgrade qemu-audio-alsaUpgrade qemu-kvmUpgrade xen-doc-htmlUpgrade qemu-ui-gtkUpgrade qemu-toolsUpgrade qemu-x86Upgrade qemu-microvmUpgrade qemu-ppcUpgrade qemu-vgabiosUpgrade qemu-hw-usb-redirectUpgrade qemu-ui-curses | Sep 9, 2016 | Aug 17, 2016 |
| Ubuntu | — | Upgrade qemu-system-armUpgrade qemu-system-aarch64Upgrade qemu-kvmUpgrade qemu-system-x86Upgrade qemu-system-sparcUpgrade qemu-system-s390xUpgrade qemu-system-ppcUpgrade qemu-system-miscUpgrade qemu-system-mipsUpgrade qemu-system | Jul 1, 2017 | Aug 12, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub