Name: CVE-2019-3812: Improper Restriction of Operations within the Bounds of a Memory Buffer
Creator: Rapid7
Published: 2019-02-19T00:00:00.000Z
License: https://www.rapid7.com/legal/website-terms-of-use/
Keywords: CVE, CVE-2019-3812, CWE-119, CWE-125, CVSS 4.4, EPSS 0.00073

QEMU, through version 2.10 and through version 3.1.0, is vulnerable to an out-of-bounds read of up to 128 bytes in the hw/i2c/i2c-ddc.c:i2c_ddc() function. A local attacker with permission to execute i2c commands could exploit this to read stack memory of the qemu process on the host.

CVSS Details

CVSS 3.1 Base Score: 4.4
CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

Covered by Rapid7

Product	Vendor Advisory	Solution File	Added	Published
Debian	—	Upgrade qemu	May 31, 2019	Feb 19, 2019
Huawei Euleros 2_0_sp8	—	Upgrade qemu-block-iscsiUpgrade qemu-commonUpgrade qemu-block-glusterUpgrade qemu-block-rbdUpgrade qemu-audio-paUpgrade qemu-block-sshUpgrade qemu-ui-gtkUpgrade qemu-kvmUpgrade qemu-block-nfsUpgrade qemu-system-aarch64-coreUpgrade qemu-block-curlUpgrade qemu-audio-sdlUpgrade qemu-system-aarch64Upgrade qemu-audio-ossUpgrade qemu-ui-cursesUpgrade qemu-audio-alsaUpgrade qemu-block-dmgUpgrade qemu-imgUpgrade qemu-ui-sdl	Aug 28, 2019	Feb 19, 2019
Oracle_linux	—	Upgrade qemu-block-glusterUpgrade qemu-system-aarch64-coreUpgrade qemu-system-aarch64Upgrade qemu-block-iscsiUpgrade ivshmem-toolsUpgrade qemu-imgUpgrade qemu-kvmUpgrade qemu-kvm-coreUpgrade qemu-block-rbdUpgrade qemuUpgrade qemu-common	May 15, 2019	Feb 18, 2019
Suse	—	Upgrade qemu-armUpgrade qemu-ksmUpgrade qemu-block-iscsiUpgrade qemu-guest-agentUpgrade qemu-block-rbdUpgrade qemu-block-sshUpgrade qemu-ipxeUpgrade qemu-toolsUpgrade qemuUpgrade qemu-seabiosUpgrade qemu-extraUpgrade qemu-langUpgrade qemu-kvmUpgrade qemu-s390Upgrade qemu-sgabiosUpgrade qemu-audio-alsaUpgrade qemu-block-glusterUpgrade qemu-block-dmgUpgrade qemu-vgabiosUpgrade qemu-ui-gtkUpgrade qemu-ui-cursesUpgrade qemu-ppcUpgrade qemu-audio-paUpgrade qemu-x86Upgrade qemu-block-curlUpgrade qemu-audio-oss	Apr 17, 2019	Feb 19, 2019
Ubuntu	—	Upgrade qemu-system-s390xUpgrade qemu-systemUpgrade qemu-system-mipsUpgrade qemu-system-miscUpgrade qemu-system-dataUpgrade qemu-system-armUpgrade qemu-system-aarch64Upgrade qemu-system-guiUpgrade qemu-system-sparcUpgrade qemu-system-x86Upgrade qemu-system-ppc	Apr 3, 2019	Feb 19, 2019

Prioritize with Active Threat Intelligence

With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.

Explore Intelligence Hub

MDR Buyer's Guide

Global Threat Landscape Report

Grow your business

CVSS Details

Covered by Rapid7

Prioritize with Active Threat Intelligence