qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in QEMU 2.12.50 has an integer overflow causing a g_malloc0() call to trigger a segmentation fault when trying to allocate a large memory chunk. The vulnerability can be exploited by sending a crafted QMP command (including guest-file-read with a large count value) to the agent via the listening socket.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu | Mar 12, 2019 | Jun 21, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade qemu-kvmUpgrade qemu-kvm-commonUpgrade qemu-img | Jun 17, 2020 | Jun 21, 2018 |
| Huawei Euleros 2_0_sp5 | — | Upgrade qemu-kvmUpgrade qemu-imgUpgrade qemu-kvm-common | Sep 24, 2019 | Jun 21, 2018 |
| Oracle_linux | — | Upgrade ivshmem-toolsUpgrade qemu-block-iscsiUpgrade qemu-block-rbdUpgrade qemu-block-glusterUpgrade qemu-system-aarch64-coreUpgrade qemuUpgrade qemu-kvmUpgrade qemu-system-aarch64Upgrade qemu-kvm-coreUpgrade qemu-system-x86-coreUpgrade qemu-commonUpgrade qemu-system-x86Upgrade qemu-img | Oct 30, 2018 | Jun 22, 2018 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jun 21, 2018 |
| Suse | — | Upgrade qemu-ui-gtkUpgrade qemu-audio-alsaUpgrade qemu-langUpgrade xen-tools-domuUpgrade qemu-ksmUpgrade qemu-audio-ossUpgrade qemu-seabiosUpgrade qemu-block-iscsiUpgrade qemu-ui-spice-appUpgrade xen-develUpgrade qemu-block-glusterUpgrade qemu-guest-agentUpgrade qemu-block-curlUpgrade qemu-audio-paUpgrade qemu-vgabiosUpgrade qemu-hw-usb-redirectUpgrade qemu-toolsUpgrade qemu-block-rbdUpgrade qemu-skibootUpgrade xenUpgrade qemu-block-sshUpgrade xen-kmp-paeUpgrade xen-toolsUpgrade qemu-ui-spice-coreUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-kvmUpgrade qemu-ppcUpgrade qemu-linux-userUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-microvmUpgrade qemu-testsuiteUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-ipxeUpgrade qemu-x86Upgrade qemu-sgabiosUpgrade qemu-block-dmgUpgrade qemu-hw-display-qxlUpgrade qemu-chardev-spiceUpgrade xen-doc-pdfUpgrade qemu-armUpgrade xen-kmp-defaultUpgrade qemu-s390xUpgrade qemu-s390Upgrade qemu-ui-openglUpgrade qemu-ui-cursesUpgrade kvmUpgrade xen-libs-32bitUpgrade qemu-extraUpgrade xen-doc-htmlUpgrade qemu-hw-display-virtio-gpuUpgrade xen-libsUpgrade qemu-audio-spiceUpgrade qemuUpgrade qemu-chardev-baum | Jul 24, 2018 | Jun 21, 2018 |
| Ubuntu | — | Upgrade qemu-system-armUpgrade qemu-system-x86Upgrade qemu-system-mipsUpgrade qemu-system-miscUpgrade qemu-system-ppcUpgrade qemu-system-sparcUpgrade qemu-systemUpgrade qemu-system-aarch64Upgrade qemu-system-s390x | Nov 30, 2018 | Jun 21, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub