The load_multiboot function in hw/i386/multiboot.c in Quick Emulator (aka QEMU) allows local guest OS users to execute arbitrary code on the QEMU host via a mh_load_end_addr value greater than mh_bss_end_addr, which triggers an out-of-bounds read or write memory access.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade qemu-kvm-debuginfoUpgrade qemu-kvm-toolsUpgrade qemu-kvmUpgrade qemu-imgUpgrade qemu-kvm-common | Apr 27, 2020 | Mar 1, 2018 |
| Amazon_linux | — | Upgrade qemu-kvm | Sep 7, 2018 | Mar 1, 2018 |
| Centos_linux | — | Upgrade qemu-kvm-commonUpgrade qemu-imgUpgrade qemu-kvmUpgrade qemu-kvm-debuginfoUpgrade qemu-kvm-tools | Aug 22, 2018 | Mar 1, 2018 |
| Debian | — | Upgrade qemuUpgrade qemu-kvm | May 31, 2018 | Mar 1, 2018 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Apr 9, 2018 | Mar 1, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade qemu-imgUpgrade qemu-kvmUpgrade qemu-kvm-common | Sep 27, 2018 | Mar 1, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade qemu-kvm-commonUpgrade qemu-kvmUpgrade qemu-img | Sep 27, 2018 | Mar 1, 2018 |
| Huawei Euleros 2_0_sp8 | — | Upgrade qemu-img | Aug 31, 2020 | Mar 1, 2018 |
| Oracle_linux | — | Upgrade qemu-system-aarch64Upgrade qemu-imgUpgrade qemu-block-iscsiUpgrade qemu-kvm-toolsUpgrade qemu-system-aarch64-coreUpgrade qemu-system-x86-coreUpgrade qemu-commonUpgrade qemu-kvmUpgrade qemu-block-rbdUpgrade qemu-kvm-coreUpgrade qemu-block-glusterUpgrade qemu-kvm-commonUpgrade qemu-system-x86Upgrade ivshmem-toolsUpgrade qemu | Aug 17, 2018 | Feb 27, 2018 |
| Redhat_linux | — | Upgrade qemu-kvm-commonUpgrade qemu-kvm-toolsUpgrade qemu-imgUpgrade qemu-kvmUpgrade qemu-kvm-debuginfo | Aug 17, 2018 | Mar 1, 2018 |
| Suse | — | Upgrade qemu-audio-spiceUpgrade qemu-langUpgrade qemu-block-rbdUpgrade xen-libs-32bitUpgrade qemu-skibootUpgrade qemu-s390xUpgrade qemu-ui-openglUpgrade qemuUpgrade qemu-block-iscsiUpgrade xen-doc-pdfUpgrade qemu-extraUpgrade xen-kmp-defaultUpgrade qemu-block-sshUpgrade xen-kmp-paeUpgrade qemu-ui-spice-appUpgrade qemu-armUpgrade qemu-ipxeUpgrade qemu-hw-display-qxlUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-s390Upgrade qemu-guest-agentUpgrade qemu-seabiosUpgrade xen-libsUpgrade qemu-chardev-spiceUpgrade xen-toolsUpgrade qemu-testsuiteUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-chardev-baumUpgrade qemu-block-dmgUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-linux-userUpgrade qemu-sgabiosUpgrade qemu-block-glusterUpgrade qemu-ui-cursesUpgrade qemu-ppcUpgrade qemu-hw-usb-redirectUpgrade xen-doc-htmlUpgrade qemu-ui-gtkUpgrade qemu-x86Upgrade qemu-block-curlUpgrade qemu-vgabiosUpgrade qemu-audio-ossUpgrade qemu-microvmUpgrade qemu-ui-spice-coreUpgrade qemu-toolsUpgrade qemu-audio-alsaUpgrade xen-develUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-audio-paUpgrade xenUpgrade qemu-ksmUpgrade kvmUpgrade xen-tools-domUUpgrade qemu-kvm | Mar 22, 2018 | Mar 1, 2018 |
| Ubuntu | — | Upgrade qemu-system-armUpgrade qemu-system-ppcUpgrade qemu-system-aarch64Upgrade qemu-system-sparcUpgrade qemu-system-x86Upgrade qemu-systemUpgrade qemu-system-mipsUpgrade qemu-system-s390x | May 23, 2018 | Mar 1, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub