The (1) v9fs_create and (2) v9fs_lcreate functions in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allow local guest OS privileged users to cause a denial of service (file descriptor or memory consumption) via vectors related to an already in-use fid.
CVSS Details
- CVSS 3.1 Base Score: 6
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemuUpgrade qemu-kvm | May 30, 2017 | Apr 10, 2017 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Oct 30, 2017 | Apr 10, 2017 |
| Suse | — | Upgrade qemu-s390Upgrade qemu-guest-agentUpgrade qemu-block-rbdUpgrade qemu-block-sshUpgrade qemuUpgrade qemu-kvmUpgrade qemu-vgabiosUpgrade qemu-ipxeUpgrade qemu-ppcUpgrade qemu-toolsUpgrade qemu-langUpgrade qemu-sgabiosUpgrade qemu-block-curlUpgrade qemu-seabiosUpgrade qemu-armUpgrade qemu-x86 | Jul 4, 2017 | Apr 10, 2017 |
| Ubuntu | — | Upgrade qemu-system-s390xUpgrade qemu-system-x86Upgrade qemu-system-armUpgrade qemu-systemUpgrade qemu-system-miscUpgrade qemu-system-mipsUpgrade qemu-system-aarch64Upgrade qemu-system-ppcUpgrade qemu-system-sparc | May 17, 2017 | Apr 10, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub