qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in QEMU 2.12.50 has an integer overflow causing a g_malloc0() call to trigger a segmentation fault when trying to allocate a large memory chunk. The vulnerability can be exploited by sending a crafted QMP command (including guest-file-read with a large count value) to the agent via the listening socket.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu | Mar 12, 2019 | Jun 21, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade qemu-kvmUpgrade qemu-imgUpgrade qemu-kvm-common | Jun 17, 2020 | Jun 21, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade qemu-kvmUpgrade qemu-imgUpgrade qemu-kvm-common | Sep 24, 2019 | Jun 21, 2018 |
| Oracle_linux | — | Upgrade ivshmem-toolsUpgrade qemu-block-iscsiUpgrade qemu-system-aarch64-coreUpgrade qemu-block-glusterUpgrade qemu-block-rbdUpgrade qemu-imgUpgrade qemu-commonUpgrade qemu-kvm-coreUpgrade qemu-kvmUpgrade qemu-system-x86-coreUpgrade qemu-system-x86Upgrade qemuUpgrade qemu-system-aarch64 | Oct 30, 2018 | Jun 22, 2018 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 21, 2018 |
| Suse | — | Upgrade qemu-guest-agentUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-block-rbdUpgrade qemu-block-glusterUpgrade qemu-ui-gtkUpgrade qemu-langUpgrade qemu-audio-ossUpgrade xen-develUpgrade qemu-skibootUpgrade qemu-kvmUpgrade qemu-audio-alsaUpgrade qemu-testsuiteUpgrade xen-toolsUpgrade qemu-seabiosUpgrade qemu-ui-spice-coreUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-block-curlUpgrade qemu-block-sshUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-toolsUpgrade qemu-block-iscsiUpgrade qemu-linux-userUpgrade qemu-ksmUpgrade xen-kmp-paeUpgrade qemu-audio-paUpgrade qemu-ppcUpgrade qemu-ui-spice-appUpgrade qemu-vgabiosUpgrade xenUpgrade qemu-microvmUpgrade qemu-hw-usb-redirectUpgrade qemu-s390xUpgrade qemu-chardev-baumUpgrade qemu-audio-spiceUpgrade qemu-ipxeUpgrade qemu-armUpgrade qemu-ui-openglUpgrade qemu-hw-display-virtio-gpuUpgrade xen-kmp-defaultUpgrade qemu-extraUpgrade xen-doc-htmlUpgrade xen-tools-domUUpgrade xen-libsUpgrade qemu-chardev-spiceUpgrade qemu-ui-cursesUpgrade xen-libs-32bitUpgrade kvmUpgrade qemu-hw-display-qxlUpgrade qemu-block-dmgUpgrade qemu-sgabiosUpgrade xen-doc-pdfUpgrade qemu-x86Upgrade qemuUpgrade qemu-s390 | Jul 24, 2018 | Jun 21, 2018 |
| Ubuntu | — | Upgrade qemu-system-aarch64Upgrade qemu-system-x86Upgrade qemu-system-mipsUpgrade qemu-systemUpgrade qemu-system-sparcUpgrade qemu-system-ppcUpgrade qemu-system-s390xUpgrade qemu-system-miscUpgrade qemu-system-arm | Nov 30, 2018 | Jun 21, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub