A stack-based buffer overflow vulnerability was found in NBD server implementation in qemu before 2.11 allowing a client to request an export name of size up to 4096 bytes, which in fact should be limited to 256 bytes, causing an out-of-bounds stack write in the qemu process. If NBD server requires TLS, the attacker cannot trigger the buffer overflow without first successfully negotiating TLS.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.0 Base Score: 8.3
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu | Jul 30, 2024 | Jul 27, 2018 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 27, 2018 |
| Suse | — | Upgrade qemu-block-iscsiUpgrade qemu-block-curlUpgrade qemu-ksmUpgrade qemu-hw-usb-redirectUpgrade qemu-s390Upgrade qemu-skibootUpgrade qemu-ui-cursesUpgrade qemu-audio-spiceUpgrade qemu-langUpgrade qemu-seabiosUpgrade qemu-kvmUpgrade qemu-chardev-baumUpgrade qemu-ui-spice-appUpgrade qemu-block-sshUpgrade qemu-audio-alsaUpgrade qemu-chardev-spiceUpgrade qemu-ui-spice-coreUpgrade qemu-ui-gtkUpgrade qemu-microvmUpgrade qemu-ipxeUpgrade qemu-ppcUpgrade qemuUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-s390xUpgrade qemu-toolsUpgrade qemu-ui-openglUpgrade qemu-audio-ossUpgrade qemu-guest-agentUpgrade qemu-x86Upgrade qemu-armUpgrade qemu-vgabiosUpgrade qemu-audio-paUpgrade qemu-hw-display-qxlUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-block-rbdUpgrade qemu-sgabios | May 20, 2018 | Feb 20, 2018 |
| Ubuntu | — | Upgrade qemu-system-x86Upgrade qemu-system-armUpgrade qemu-system-s390xUpgrade qemu-systemUpgrade qemu-system-aarch64Upgrade qemu-system-sparcUpgrade qemu-system-miscUpgrade qemu-system-ppcUpgrade qemu-system-mips | Feb 21, 2018 | Feb 20, 2018 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub