QEMU, through version 2.10 and through version 3.1.0, is vulnerable to an out-of-bounds read of up to 128 bytes in the hw/i2c/i2c-ddc.c:i2c_ddc() function. A local attacker with permission to execute i2c commands could exploit this to read stack memory of the qemu process on the host.
CVSS Details
- CVSS 3.1 Base Score: 4.4
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu | May 31, 2019 | Feb 19, 2019 |
| Huawei Euleros 2_0_sp8 | — | Upgrade qemu-audio-ossUpgrade qemu-block-curlUpgrade qemu-system-aarch64-coreUpgrade qemu-block-dmgUpgrade qemu-ui-sdlUpgrade qemu-system-aarch64Upgrade qemu-audio-alsaUpgrade qemu-imgUpgrade qemu-ui-cursesUpgrade qemu-audio-sdlUpgrade qemu-kvmUpgrade qemu-block-sshUpgrade qemu-audio-paUpgrade qemu-ui-gtkUpgrade qemu-block-rbdUpgrade qemu-block-glusterUpgrade qemu-block-iscsiUpgrade qemu-commonUpgrade qemu-block-nfs | Aug 28, 2019 | Feb 19, 2019 |
| Oracle_linux | — | Upgrade qemu-system-aarch64Upgrade qemu-system-aarch64-coreUpgrade qemu-block-glusterUpgrade qemu-imgUpgrade ivshmem-toolsUpgrade qemu-block-iscsiUpgrade qemuUpgrade qemu-kvm-coreUpgrade qemu-commonUpgrade qemu-block-rbdUpgrade qemu-kvm | May 15, 2019 | Feb 18, 2019 |
| Suse | — | Upgrade qemu-vgabiosUpgrade qemu-block-curlUpgrade qemu-s390Upgrade qemu-audio-alsaUpgrade qemu-sgabiosUpgrade qemu-block-glusterUpgrade qemu-kvmUpgrade qemu-ppcUpgrade qemu-audio-paUpgrade qemu-block-dmgUpgrade qemu-ui-cursesUpgrade qemu-x86Upgrade qemu-ui-gtkUpgrade qemu-audio-ossUpgrade qemu-toolsUpgrade qemu-ipxeUpgrade qemu-ksmUpgrade qemu-block-sshUpgrade qemu-guest-agentUpgrade qemu-langUpgrade qemu-block-iscsiUpgrade qemu-extraUpgrade qemu-seabiosUpgrade qemu-block-rbdUpgrade qemu-armUpgrade qemu | Apr 17, 2019 | Feb 19, 2019 |
| Ubuntu | — | Upgrade qemu-systemUpgrade qemu-system-s390xUpgrade qemu-system-mipsUpgrade qemu-system-armUpgrade qemu-system-dataUpgrade qemu-system-miscUpgrade qemu-system-aarch64Upgrade qemu-system-guiUpgrade qemu-system-ppcUpgrade qemu-system-x86Upgrade qemu-system-sparc | Apr 3, 2019 | Feb 19, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub