qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in QEMU 2.12.50 has an integer overflow causing a g_malloc0() call to trigger a segmentation fault when trying to allocate a large memory chunk. The vulnerability can be exploited by sending a crafted QMP command (including guest-file-read with a large count value) to the agent via the listening socket.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu | Mar 12, 2019 | Jun 21, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade qemu-kvmUpgrade qemu-imgUpgrade qemu-kvm-common | Jun 17, 2020 | Jun 21, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade qemu-kvmUpgrade qemu-kvm-commonUpgrade qemu-img | Sep 24, 2019 | Jun 21, 2018 |
| Oracle_linux | — | Upgrade qemu-commonUpgrade qemu-kvmUpgrade qemu-system-x86-coreUpgrade qemuUpgrade qemu-system-aarch64Upgrade qemu-system-x86Upgrade qemu-kvm-coreUpgrade qemu-imgUpgrade qemu-block-glusterUpgrade qemu-system-aarch64-coreUpgrade qemu-block-rbdUpgrade ivshmem-toolsUpgrade qemu-block-iscsi | Oct 30, 2018 | Jun 22, 2018 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 21, 2018 |
| Suse | — | Upgrade xen-libsUpgrade xen-tools-domUUpgrade xen-doc-htmlUpgrade xen-doc-pdfUpgrade xen-libs-32bitUpgrade kvmUpgrade xen-kmp-defaultUpgrade qemu-ui-cursesUpgrade qemu-ipxeUpgrade qemu-ui-openglUpgrade qemu-sgabiosUpgrade qemu-chardev-spiceUpgrade qemu-audio-spiceUpgrade qemu-s390xUpgrade qemu-x86Upgrade qemu-extraUpgrade qemu-s390Upgrade qemuUpgrade qemu-block-dmgUpgrade qemu-hw-display-qxlUpgrade qemu-armUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-chardev-baumUpgrade qemu-kvmUpgrade xenUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-ui-spice-coreUpgrade qemu-block-sshUpgrade qemu-block-curlUpgrade xen-toolsUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-guest-agentUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-linux-userUpgrade qemu-block-rbdUpgrade qemu-seabiosUpgrade qemu-ksmUpgrade qemu-block-glusterUpgrade qemu-vgabiosUpgrade xen-kmp-paeUpgrade qemu-microvmUpgrade qemu-hw-usb-redirectUpgrade xen-develUpgrade qemu-ppcUpgrade qemu-ui-spice-appUpgrade qemu-audio-ossUpgrade qemu-audio-paUpgrade qemu-block-iscsiUpgrade qemu-audio-alsaUpgrade qemu-toolsUpgrade qemu-ui-gtkUpgrade qemu-langUpgrade qemu-skibootUpgrade qemu-testsuite | Jul 24, 2018 | Jun 21, 2018 |
| Ubuntu | — | Upgrade qemu-system-ppcUpgrade qemu-system-aarch64Upgrade qemu-system-mipsUpgrade qemu-systemUpgrade qemu-system-s390xUpgrade qemu-system-miscUpgrade qemu-system-sparcUpgrade qemu-system-x86Upgrade qemu-system-arm | Nov 30, 2018 | Jun 21, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub