qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in QEMU 2.12.50 has an integer overflow causing a g_malloc0() call to trigger a segmentation fault when trying to allocate a large memory chunk. The vulnerability can be exploited by sending a crafted QMP command (including guest-file-read with a large count value) to the agent via the listening socket.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu | Mar 12, 2019 | Jun 21, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade qemu-imgUpgrade qemu-kvm-commonUpgrade qemu-kvm | Jun 17, 2020 | Jun 21, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade qemu-kvmUpgrade qemu-imgUpgrade qemu-kvm-common | Sep 24, 2019 | Jun 21, 2018 |
| Oracle_linux | — | Upgrade qemu-system-aarch64Upgrade qemu-system-x86Upgrade qemuUpgrade qemu-kvmUpgrade qemu-system-x86-coreUpgrade qemu-imgUpgrade qemu-kvm-coreUpgrade qemu-commonUpgrade qemu-block-glusterUpgrade qemu-block-iscsiUpgrade qemu-system-aarch64-coreUpgrade ivshmem-toolsUpgrade qemu-block-rbd | Oct 30, 2018 | Jun 22, 2018 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 21, 2018 |
| Suse | — | Upgrade qemu-ksmUpgrade qemu-langUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-microvmUpgrade qemu-vgabiosUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-block-sshUpgrade qemu-block-curlUpgrade xen-toolsUpgrade qemu-linux-userUpgrade qemu-toolsUpgrade qemu-kvmUpgrade qemu-ui-spice-coreUpgrade qemu-testsuiteUpgrade xenUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-seabiosUpgrade qemu-ui-spice-appUpgrade qemu-block-iscsiUpgrade xen-develUpgrade xen-kmp-paeUpgrade qemu-hw-usb-redirectUpgrade qemu-guest-agentUpgrade qemu-ppcUpgrade qemu-block-rbdUpgrade qemu-block-glusterUpgrade qemu-skibootUpgrade qemu-audio-paUpgrade qemu-audio-alsaUpgrade qemu-ui-gtkUpgrade qemu-audio-ossUpgrade qemu-s390Upgrade xen-libs-32bitUpgrade qemu-ipxeUpgrade qemu-s390xUpgrade xen-kmp-defaultUpgrade qemu-x86Upgrade qemu-chardev-spiceUpgrade xen-doc-htmlUpgrade qemuUpgrade xen-libsUpgrade qemu-ui-cursesUpgrade kvmUpgrade xen-tools-domUUpgrade qemu-chardev-baumUpgrade qemu-extraUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-audio-spiceUpgrade xen-doc-pdfUpgrade qemu-block-dmgUpgrade qemu-armUpgrade qemu-hw-display-qxlUpgrade qemu-sgabiosUpgrade qemu-ui-opengl | Jul 24, 2018 | Jun 21, 2018 |
| Ubuntu | — | Upgrade qemu-system-armUpgrade qemu-system-sparcUpgrade qemu-system-s390xUpgrade qemu-system-miscUpgrade qemu-system-ppcUpgrade qemu-system-mipsUpgrade qemu-system-x86Upgrade qemu-system-aarch64Upgrade qemu-system | Nov 30, 2018 | Jun 21, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub