qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in QEMU 2.12.50 has an integer overflow causing a g_malloc0() call to trigger a segmentation fault when trying to allocate a large memory chunk. The vulnerability can be exploited by sending a crafted QMP command (including guest-file-read with a large count value) to the agent via the listening socket.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu | Mar 12, 2019 | Jun 21, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade qemu-kvmUpgrade qemu-imgUpgrade qemu-kvm-common | Jun 17, 2020 | Jun 21, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade qemu-kvmUpgrade qemu-imgUpgrade qemu-kvm-common | Sep 24, 2019 | Jun 21, 2018 |
| Oracle_linux | — | Upgrade ivshmem-toolsUpgrade qemu-system-aarch64-coreUpgrade qemu-block-rbdUpgrade qemu-block-iscsiUpgrade qemu-block-glusterUpgrade qemu-kvm-coreUpgrade qemu-imgUpgrade qemu-kvmUpgrade qemu-system-x86Upgrade qemu-system-aarch64Upgrade qemu-commonUpgrade qemu-system-x86-coreUpgrade qemu | Oct 30, 2018 | Jun 22, 2018 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 21, 2018 |
| Suse | — | Upgrade qemu-ppcUpgrade qemu-audio-paUpgrade qemu-ui-spice-coreUpgrade qemu-block-glusterUpgrade qemu-block-rbdUpgrade qemu-ksmUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-block-iscsiUpgrade qemu-langUpgrade qemu-audio-alsaUpgrade qemu-guest-agentUpgrade xen-develUpgrade qemu-testsuiteUpgrade qemu-toolsUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-vgabiosUpgrade qemu-microvmUpgrade qemu-audio-ossUpgrade qemu-ui-spice-appUpgrade qemu-skibootUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade xen-toolsUpgrade xenUpgrade qemu-block-sshUpgrade qemu-linux-userUpgrade qemu-kvmUpgrade xen-kmp-paeUpgrade qemu-block-curlUpgrade qemu-hw-usb-redirectUpgrade qemu-seabiosUpgrade qemu-ui-gtkUpgrade qemu-hw-display-qxlUpgrade qemu-armUpgrade qemu-x86Upgrade qemuUpgrade qemu-chardev-spiceUpgrade xen-libsUpgrade xen-doc-htmlUpgrade xen-tools-domUUpgrade qemu-ui-cursesUpgrade qemu-extraUpgrade qemu-chardev-baumUpgrade qemu-sgabiosUpgrade qemu-hw-display-virtio-gpuUpgrade kvmUpgrade qemu-ui-openglUpgrade qemu-ipxeUpgrade qemu-block-dmgUpgrade qemu-s390xUpgrade qemu-s390Upgrade qemu-audio-spiceUpgrade xen-libs-32bitUpgrade xen-kmp-defaultUpgrade xen-doc-pdf | Jul 24, 2018 | Jun 21, 2018 |
| Ubuntu | — | Upgrade qemu-system-armUpgrade qemu-system-sparcUpgrade qemu-system-s390xUpgrade qemu-system-x86Upgrade qemu-systemUpgrade qemu-system-mipsUpgrade qemu-system-aarch64Upgrade qemu-system-ppcUpgrade qemu-system-misc | Nov 30, 2018 | Jun 21, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub