qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in QEMU 2.12.50 has an integer overflow causing a g_malloc0() call to trigger a segmentation fault when trying to allocate a large memory chunk. The vulnerability can be exploited by sending a crafted QMP command (including guest-file-read with a large count value) to the agent via the listening socket.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu | Mar 12, 2019 | Jun 21, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade qemu-kvmUpgrade qemu-imgUpgrade qemu-kvm-common | Jun 17, 2020 | Jun 21, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade qemu-kvmUpgrade qemu-kvm-commonUpgrade qemu-img | Sep 24, 2019 | Jun 21, 2018 |
| Oracle_linux | — | Upgrade qemu-imgUpgrade qemu-system-aarch64Upgrade qemuUpgrade qemu-kvm-coreUpgrade qemu-kvmUpgrade qemu-commonUpgrade qemu-system-x86Upgrade qemu-system-x86-coreUpgrade qemu-block-rbdUpgrade qemu-block-glusterUpgrade ivshmem-toolsUpgrade qemu-block-iscsiUpgrade qemu-system-aarch64-core | Oct 30, 2018 | Jun 22, 2018 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 21, 2018 |
| Suse | — | Upgrade qemu-block-curlUpgrade xen-toolsUpgrade qemu-block-sshUpgrade xen-kmp-paeUpgrade qemu-vgabiosUpgrade qemu-audio-paUpgrade qemu-block-glusterUpgrade qemu-ppcUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-skibootUpgrade qemu-ui-gtkUpgrade qemu-audio-ossUpgrade qemu-audio-alsaUpgrade qemu-ksmUpgrade qemu-langUpgrade xen-develUpgrade qemu-seabiosUpgrade qemu-ui-spice-appUpgrade qemu-block-iscsiUpgrade xenUpgrade qemu-hw-usb-redirectUpgrade qemu-testsuiteUpgrade qemu-toolsUpgrade qemu-ui-spice-coreUpgrade qemu-microvmUpgrade qemu-kvmUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-block-rbdUpgrade qemu-guest-agentUpgrade qemu-linux-userUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-ipxeUpgrade xen-tools-domUUpgrade xen-libsUpgrade xen-doc-htmlUpgrade qemuUpgrade qemu-x86Upgrade qemu-ui-cursesUpgrade qemu-ui-openglUpgrade xen-libs-32bitUpgrade kvmUpgrade xen-kmp-defaultUpgrade qemu-audio-spiceUpgrade qemu-block-dmgUpgrade qemu-hw-display-qxlUpgrade qemu-chardev-baumUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-s390Upgrade qemu-armUpgrade qemu-extraUpgrade qemu-chardev-spiceUpgrade qemu-sgabiosUpgrade qemu-s390xUpgrade xen-doc-pdf | Jul 24, 2018 | Jun 21, 2018 |
| Ubuntu | — | Upgrade qemu-system-armUpgrade qemu-system-mipsUpgrade qemu-system-x86Upgrade qemu-system-sparcUpgrade qemu-systemUpgrade qemu-system-ppcUpgrade qemu-system-aarch64Upgrade qemu-system-miscUpgrade qemu-system-s390x | Nov 30, 2018 | Jun 21, 2018 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub