qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in QEMU 2.12.50 has an integer overflow causing a g_malloc0() call to trigger a segmentation fault when trying to allocate a large memory chunk. The vulnerability can be exploited by sending a crafted QMP command (including guest-file-read with a large count value) to the agent via the listening socket.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu | Mar 12, 2019 | Jun 21, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade qemu-kvmUpgrade qemu-kvm-commonUpgrade qemu-img | Jun 17, 2020 | Jun 21, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade qemu-imgUpgrade qemu-kvm-commonUpgrade qemu-kvm | Sep 24, 2019 | Jun 21, 2018 |
| Oracle_linux | — | Upgrade qemu-system-aarch64-coreUpgrade qemu-block-glusterUpgrade qemu-block-rbdUpgrade ivshmem-toolsUpgrade qemu-block-iscsiUpgrade qemu-imgUpgrade qemu-system-aarch64Upgrade qemu-system-x86-coreUpgrade qemu-system-x86Upgrade qemu-kvmUpgrade qemuUpgrade qemu-kvm-coreUpgrade qemu-common | Oct 30, 2018 | Jun 22, 2018 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 21, 2018 |
| Suse | — | Upgrade qemu-audio-alsaUpgrade qemu-audio-ossUpgrade qemu-seabiosUpgrade xen-tools-domuUpgrade qemu-block-iscsiUpgrade qemu-langUpgrade qemu-block-rbdUpgrade qemu-ui-gtkUpgrade qemu-ksmUpgrade qemu-block-glusterUpgrade qemu-ppcUpgrade qemu-guest-agentUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-hw-usb-redirectUpgrade qemu-ui-spice-appUpgrade qemu-kvmUpgrade qemu-audio-paUpgrade qemu-vgabiosUpgrade qemu-toolsUpgrade qemu-microvmUpgrade xen-develUpgrade qemu-testsuiteUpgrade qemu-ui-spice-coreUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-block-sshUpgrade qemu-hw-display-virtio-gpu-pciUpgrade xen-kmp-paeUpgrade qemu-linux-userUpgrade xen-toolsUpgrade qemu-skibootUpgrade xenUpgrade qemu-block-curlUpgrade qemu-armUpgrade qemu-ui-openglUpgrade qemu-chardev-baumUpgrade qemu-extraUpgrade qemu-block-dmgUpgrade qemu-sgabiosUpgrade qemu-hw-display-qxlUpgrade xen-doc-pdfUpgrade xen-kmp-defaultUpgrade xen-libsUpgrade xen-doc-htmlUpgrade qemu-s390xUpgrade qemu-chardev-spiceUpgrade qemu-ipxeUpgrade qemu-ui-cursesUpgrade xen-libs-32bitUpgrade kvmUpgrade qemu-audio-spiceUpgrade qemu-s390Upgrade qemu-x86Upgrade qemuUpgrade qemu-hw-display-virtio-gpu | Jul 24, 2018 | Jun 21, 2018 |
| Ubuntu | — | Upgrade qemu-systemUpgrade qemu-system-aarch64Upgrade qemu-system-ppcUpgrade qemu-system-s390xUpgrade qemu-system-miscUpgrade qemu-system-sparcUpgrade qemu-system-x86Upgrade qemu-system-mipsUpgrade qemu-system-arm | Nov 30, 2018 | Jun 21, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub