qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in QEMU 2.12.50 has an integer overflow causing a g_malloc0() call to trigger a segmentation fault when trying to allocate a large memory chunk. The vulnerability can be exploited by sending a crafted QMP command (including guest-file-read with a large count value) to the agent via the listening socket.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu | Mar 12, 2019 | Jun 21, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade qemu-imgUpgrade qemu-kvm-commonUpgrade qemu-kvm | Jun 17, 2020 | Jun 21, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade qemu-kvmUpgrade qemu-imgUpgrade qemu-kvm-common | Sep 24, 2019 | Jun 21, 2018 |
| Oracle_linux | — | Upgrade ivshmem-toolsUpgrade qemu-block-rbdUpgrade qemu-block-iscsiUpgrade qemu-system-aarch64-coreUpgrade qemu-block-glusterUpgrade qemuUpgrade qemu-imgUpgrade qemu-system-aarch64Upgrade qemu-system-x86Upgrade qemu-kvmUpgrade qemu-system-x86-coreUpgrade qemu-kvm-coreUpgrade qemu-common | Oct 30, 2018 | Jun 22, 2018 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 21, 2018 |
| Suse | — | Upgrade xen-libsUpgrade qemu-x86Upgrade qemuUpgrade qemu-s390xUpgrade qemu-s390Upgrade xen-kmp-defaultUpgrade qemu-ipxeUpgrade qemu-armUpgrade qemu-block-dmgUpgrade qemu-hw-display-qxlUpgrade qemu-hw-display-virtio-gpuUpgrade xen-doc-pdfUpgrade qemu-ui-openglUpgrade qemu-sgabiosUpgrade qemu-extraUpgrade kvmUpgrade qemu-chardev-baumUpgrade qemu-ui-cursesUpgrade xen-doc-htmlUpgrade xen-libs-32bitUpgrade qemu-audio-spiceUpgrade qemu-chardev-spiceUpgrade qemu-audio-alsaUpgrade qemu-ui-gtkUpgrade qemu-block-rbdUpgrade qemu-langUpgrade qemu-audio-ossUpgrade qemu-seabiosUpgrade qemu-block-iscsiUpgrade xen-tools-domuUpgrade qemu-microvmUpgrade xen-kmp-paeUpgrade qemu-hw-usb-redirectUpgrade qemu-vgabiosUpgrade qemu-ui-spice-appUpgrade xen-develUpgrade qemu-audio-paUpgrade qemu-ppcUpgrade qemu-toolsUpgrade qemu-testsuiteUpgrade qemu-block-glusterUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-ksmUpgrade qemu-guest-agentUpgrade xenUpgrade qemu-skibootUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-kvmUpgrade qemu-block-sshUpgrade qemu-ui-spice-coreUpgrade qemu-hw-display-virtio-gpu-pciUpgrade xen-toolsUpgrade qemu-block-curlUpgrade qemu-linux-user | Jul 24, 2018 | Jun 21, 2018 |
| Ubuntu | — | Upgrade qemu-system-miscUpgrade qemu-system-mipsUpgrade qemu-systemUpgrade qemu-system-sparcUpgrade qemu-system-s390xUpgrade qemu-system-ppcUpgrade qemu-system-x86Upgrade qemu-system-aarch64Upgrade qemu-system-arm | Nov 30, 2018 | Jun 21, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub