CVE-2017-15289LOW
Description
The mode4and5 write functions in hw/display/cirrus_vga.c in Qemu allow local OS guest privileged users to cause a denial of service (out-of-bounds write access and Qemu process crash) via vectors related to dst calculation.
References
http://www.openwall.com/lists/oss-security/2017/10/12/16
http://www.securityfocus.com/bid/101262
https://access.redhat.com/errata/RHSA-2017:3368
https://access.redhat.com/errata/RHSA-2017:3369
https://access.redhat.com/errata/RHSA-2017:3466
https://access.redhat.com/errata/RHSA-2017:3470
https://access.redhat.com/errata/RHSA-2017:3471
https://access.redhat.com/errata/RHSA-2017:3472
https://access.redhat.com/errata/RHSA-2017:3473
https://access.redhat.com/errata/RHSA-2017:3474
https://access.redhat.com/errata/RHSA-2018:0516
https://bugzilla.redhat.com/show_bug.cgi?id=1501290
https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
https://lists.gnu.org/archive/html/qemu-devel/2017-10/msg02557.html
Details
Source: MITRE
Published: 2017-10-16
Updated: 2020-11-10
Type: CWE-787
Risk Information
CVSS v2.0
Base Score: 2.1
Vector: AV:L/AC:L/Au:N/C:N/I:N/A:P
Impact Score: 2.9
Exploitability Score: 3.9
Severity: LOW
CVSS v3.0
Base Score: 6
Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H
Impact Score: 4
Exploitability Score: 1.5
Severity: MEDIUM
Vulnerable Software
Configuration 1
OR
cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:* versions up to 2.10.2 (inclusive)
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 140019 | OracleVM 3.4 : xen (OVMSA-2020-0039) (Bunker Buster) (Foreshadow) (MDSUM/RIDL) (MFBDS/RIDL/ZombieLoad) (MLPDS/RIDL) (MSBDS/Fallout) (Meltdown) (POODLE) (Spectre) | Nessus | OracleVM Local Security Checks | critical |
| 138415 | OracleVM 3.4 : xen (OVMSA-2020-0027) (deprecated) | Nessus | OracleVM Local Security Checks | low |
| 127374 | NewStart CGSL MAIN 4.05 : qemu-kvm Vulnerability (NS-SA-2019-0125) | Nessus | NewStart CGSL Local Security Checks | low |
| 127149 | NewStart CGSL MAIN 5.04 : qemu-kvm Multiple Vulnerabilities (NS-SA-2019-0005) | Nessus | NewStart CGSL Local Security Checks | high |
| 117351 | Debian DLA-1497-1 : qemu security update (Spectre) | Nessus | Debian Local Security Checks | high |
| 111023 | OracleVM 3.4 : qemu-kvm (OVMSA-2018-0238) (Spectre) | Nessus | OracleVM Local Security Checks | high |
| 110208 | Debian DSA-4213-1 : qemu - security update (Spectre) | Nessus | Debian Local Security Checks | high |
| 108366 | Scientific Linux Security Update : qemu-kvm on SL6.x i386/x86_64 (20180313) | Nessus | Scientific Linux Local Security Checks | low |
| 108360 | OracleVM 3.4 : qemu-kvm (OVMSA-2018-0025) | Nessus | OracleVM Local Security Checks | low |
| 108343 | CentOS 6 : qemu-kvm (CESA-2018:0516) | Nessus | CentOS Local Security Checks | low |
| 108331 | RHEL 6 : qemu-kvm (RHSA-2018:0516) | Nessus | Red Hat Local Security Checks | low |
| 108321 | Oracle Linux 6 : qemu-kvm (ELSA-2018-0516) | Nessus | Oracle Linux Local Security Checks | low |
| 107145 | Ubuntu 14.04 LTS / 16.04 LTS : qemu regression (USN-3575-2) | Nessus | Ubuntu Local Security Checks | high |
| 106927 | Ubuntu 14.04 LTS / 16.04 LTS / 17.10 : qemu vulnerabilities (USN-3575-1) | Nessus | Ubuntu Local Security Checks | high |
| 105419 | Amazon Linux AMI : qemu-kvm (ALAS-2017-934) | Nessus | Amazon Linux Local Security Checks | high |
| 105302 | EulerOS 2.0 SP2 : qemu-kvm (EulerOS-SA-2017-1321) | Nessus | Huawei Local Security Checks | high |
| 105301 | EulerOS 2.0 SP1 : qemu-kvm (EulerOS-SA-2017-1320) | Nessus | Huawei Local Security Checks | high |
| 105222 | openSUSE Security Update : xen (openSUSE-2017-1322) | Nessus | SuSE Local Security Checks | high |
| 105221 | openSUSE Security Update : xen (openSUSE-2017-1321) | Nessus | SuSE Local Security Checks | high |
| 105149 | SUSE SLES11 Security Update : xen (SUSE-SU-2017:3242-1) | Nessus | SuSE Local Security Checks | high |
| 105148 | SUSE SLES12 Security Update : xen (SUSE-SU-2017:3239-1) | Nessus | SuSE Local Security Checks | high |
| 105098 | SUSE SLES12 Security Update : xen (SUSE-SU-2017:3236-1) | Nessus | SuSE Local Security Checks | high |
| 105057 | CentOS 7 : qemu-kvm (CESA-2017:3368) | Nessus | CentOS Local Security Checks | high |
| 105033 | SUSE SLES11 Security Update : xen (SUSE-SU-2017:3212-1) | Nessus | SuSE Local Security Checks | high |
| 104992 | SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2017:3178-1) | Nessus | SuSE Local Security Checks | high |
| 104990 | Scientific Linux Security Update : qemu-kvm on SL7.x x86_64 (20171130) | Nessus | Scientific Linux Local Security Checks | high |
| 104987 | RHEL 7 : qemu-kvm-rhev (RHSA-2017:3369) | Nessus | Red Hat Local Security Checks | high |
| 104951 | RHEL 7 : qemu-kvm (RHSA-2017:3368) | Nessus | Red Hat Local Security Checks | high |
| 104948 | Oracle Linux 7 : qemu-kvm (ELSA-2017-3368) | Nessus | Oracle Linux Local Security Checks | high |
| 104870 | SUSE SLED12 / SLES12 Security Update : xen (SUSE-SU-2017:3115-1) | Nessus | SuSE Local Security Checks | high |
| 104780 | SUSE SLES11 Security Update : kvm (SUSE-SU-2017:3084-1) | Nessus | SuSE Local Security Checks | high |
| 104495 | SUSE SLES12 Security Update : qemu (SUSE-SU-2017:2969-1) | Nessus | SuSE Local Security Checks | high |
| 104494 | SUSE SLES11 Security Update : kvm (SUSE-SU-2017:2963-1) | Nessus | SuSE Local Security Checks | high |
| 104471 | SUSE SLES12 Security Update : qemu (SUSE-SU-2017:2946-1) | Nessus | SuSE Local Security Checks | high |
| 104429 | SUSE SLED12 / SLES12 Security Update : qemu (SUSE-SU-2017:2936-1) | Nessus | SuSE Local Security Checks | high |
| 104424 | openSUSE Security Update : qemu (openSUSE-2017-1249) | Nessus | SuSE Local Security Checks | high |
| 104423 | openSUSE Security Update : qemu (openSUSE-2017-1248) | Nessus | SuSE Local Security Checks | high |
| 104376 | SUSE SLED12 / SLES12 Security Update : qemu (SUSE-SU-2017:2924-1) | Nessus | SuSE Local Security Checks | high |