The load_multiboot function in hw/i386/multiboot.c in Quick Emulator (aka QEMU) allows local guest OS users to execute arbitrary code on the QEMU host via a mh_load_end_addr value greater than mh_bss_end_addr, which triggers an out-of-bounds read or write memory access.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade qemu-kvm-debuginfoUpgrade qemu-kvm-commonUpgrade qemu-kvm-toolsUpgrade qemu-imgUpgrade qemu-kvm | Apr 27, 2020 | Mar 1, 2018 |
| Amazon_linux | — | Upgrade qemu-kvm | Sep 7, 2018 | Mar 1, 2018 |
| Centos_linux | — | Upgrade qemu-kvm-commonUpgrade qemu-kvmUpgrade qemu-kvm-debuginfoUpgrade qemu-imgUpgrade qemu-kvm-tools | Aug 22, 2018 | Mar 1, 2018 |
| Debian | — | Upgrade qemu-kvmUpgrade qemu | May 31, 2018 | Mar 1, 2018 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Apr 9, 2018 | Mar 1, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade qemu-imgUpgrade qemu-kvmUpgrade qemu-kvm-common | Sep 27, 2018 | Mar 1, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade qemu-imgUpgrade qemu-kvmUpgrade qemu-kvm-common | Sep 27, 2018 | Mar 1, 2018 |
| Huawei Euleros 2_0_sp8 | — | Upgrade qemu-img | Aug 31, 2020 | Mar 1, 2018 |
| Oracle_linux | — | Upgrade qemu-system-x86Upgrade qemu-block-glusterUpgrade qemu-kvm-commonUpgrade ivshmem-toolsUpgrade qemuUpgrade qemu-commonUpgrade qemu-kvmUpgrade qemu-imgUpgrade qemu-system-x86-coreUpgrade qemu-block-iscsiUpgrade qemu-kvm-toolsUpgrade qemu-system-aarch64-coreUpgrade qemu-system-aarch64Upgrade qemu-kvm-coreUpgrade qemu-block-rbd | Aug 17, 2018 | Feb 27, 2018 |
| Redhat_linux | — | Upgrade qemu-kvm-commonUpgrade qemu-kvmUpgrade qemu-imgUpgrade qemu-kvm-toolsUpgrade qemu-kvm-debuginfo | Aug 17, 2018 | Mar 1, 2018 |
| Suse | — | Upgrade qemu-s390xUpgrade xen-kmp-defaultUpgrade xen-toolsUpgrade qemu-testsuiteUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemuUpgrade xen-libs-32bitUpgrade qemu-armUpgrade qemu-block-rbdUpgrade qemu-skibootUpgrade qemu-audio-spiceUpgrade qemu-block-iscsiUpgrade qemu-ui-openglUpgrade qemu-ui-spice-appUpgrade qemu-block-sshUpgrade xen-kmp-paeUpgrade qemu-hw-display-virtio-gpuUpgrade xen-libsUpgrade qemu-s390Upgrade xen-doc-pdfUpgrade qemu-guest-agentUpgrade qemu-langUpgrade qemu-hw-display-qxlUpgrade qemu-extraUpgrade qemu-ipxeUpgrade qemu-chardev-baumUpgrade qemu-chardev-spiceUpgrade qemu-seabiosUpgrade qemu-sgabiosUpgrade qemu-kvmUpgrade qemu-block-curlUpgrade xen-doc-htmlUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-audio-ossUpgrade xen-develUpgrade qemu-audio-paUpgrade kvmUpgrade qemu-linux-userUpgrade xenUpgrade qemu-ksmUpgrade qemu-microvmUpgrade qemu-block-dmgUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-ui-gtkUpgrade qemu-audio-alsaUpgrade qemu-x86Upgrade qemu-vgabiosUpgrade xen-tools-domUUpgrade qemu-ui-cursesUpgrade qemu-ppcUpgrade qemu-block-glusterUpgrade qemu-toolsUpgrade qemu-ui-spice-coreUpgrade qemu-hw-usb-redirect | Mar 22, 2018 | Mar 1, 2018 |
| Ubuntu | — | Upgrade qemu-system-armUpgrade qemu-system-ppcUpgrade qemu-system-sparcUpgrade qemu-system-x86Upgrade qemu-system-aarch64Upgrade qemu-system-mipsUpgrade qemu-system-s390xUpgrade qemu-system | May 23, 2018 | Mar 1, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub