CVE-2017-2615 Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A pri...
CriticalCVSS 9.1
EPSS 3.6%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/qemu(Debian:12) | < 1:2.8+dfsg-3 | 1:2.8+dfsg-3 |
| debian/qemu(Debian:13) | < 1:2.8+dfsg-3 | 1:2.8+dfsg-3 |
| debian/qemu(Debian:14) | < 1:2.8+dfsg-3 | 1:2.8+dfsg-3 |
| qemu | <= 2.8.0 | No fix listed |
| citrix xenserver | = 6.0.2 | No fix listed |
| citrix xenserver | = 6.2.0-sp1 | No fix listed |
| citrix xenserver | = 6.5-sp1 | No fix listed |
| citrix xenserver | = 7.0 | No fix listed |
| citrix xenserver | = 7.1 | No fix listed |
| redhat openstack | = 5.0 | No fix listed |
| redhat openstack | = 6.0 | No fix listed |
| redhat openstack | = 7.0 | No fix listed |
| redhat openstack | = 8 | No fix listed |
| redhat openstack | = 9 | No fix listed |
| redhat openstack | = 10 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server aus | = 7.3 | No fix listed |
| redhat enterprise linux server aus | = 7.4 | No fix listed |
| redhat enterprise linux server eus | = 7.3 | No fix listed |
| redhat enterprise linux server eus | = 7.4 | No fix listed |
| redhat enterprise linux server eus | = 7.5 | No fix listed |
Show 50 more
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat enterprise linux workstation | = 6.0 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| Xen | <= 4.7.1 | No fix listed |
| Xen | = 4.7.1-r1 | No fix listed |
| Xen | = 4.7.1-r2 | No fix listed |
| Xen | = 4.7.1-r3 | No fix listed |
| Xen | = 4.7.1-r4 | No fix listed |
| alpine/qemu(Alpine:v3.10) | < 2.8.1-r1 | 2.8.1-r1 |
| alpine/qemu(Alpine:v3.11) | < 2.8.1-r1 | 2.8.1-r1 |
| alpine/qemu(Alpine:v3.12) | < 2.8.1-r1 | 2.8.1-r1 |
| alpine/qemu(Alpine:v3.13) | < 2.8.1-r1 | 2.8.1-r1 |
| alpine/qemu(Alpine:v3.14) | < 2.8.1-r1 | 2.8.1-r1 |
| alpine/qemu(Alpine:v3.15) | < 2.8.1-r1 | 2.8.1-r1 |
| alpine/qemu(Alpine:v3.16) | < 2.8.1-r1 | 2.8.1-r1 |
| alpine/qemu(Alpine:v3.17) | < 2.8.1-r1 | 2.8.1-r1 |
| alpine/qemu(Alpine:v3.18) | < 2.8.1-r1 | 2.8.1-r1 |
| alpine/qemu(Alpine:v3.19) | < 2.8.1-r1 | 2.8.1-r1 |
| alpine/qemu(Alpine:v3.20) | < 2.8.1-r1 | 2.8.1-r1 |
| alpine/qemu(Alpine:v3.21) | < 2.8.1-r1 | 2.8.1-r1 |
| alpine/qemu(Alpine:v3.22) | < 2.8.1-r1 | 2.8.1-r1 |
| alpine/qemu(Alpine:v3.23) | < 2.8.1-r1 | 2.8.1-r1 |
| alpine/qemu(Alpine:v3.24) | < 2.8.1-r1 | 2.8.1-r1 |
| alpine/qemu(Alpine:v3.5) | < 2.8.1.1-r0 | 2.8.1.1-r0 |
| alpine/qemu(Alpine:v3.6) | < 2.8.1-r1 | 2.8.1-r1 |
| alpine/qemu(Alpine:v3.7) | < 2.8.1-r1 | 2.8.1-r1 |
| alpine/qemu(Alpine:v3.8) | < 2.8.1-r1 | 2.8.1-r1 |
| alpine/qemu(Alpine:v3.9) | < 2.8.1-r1 | 2.8.1-r1 |
| alpine/xen(Alpine:v3.10) | < 4.7.1-r5 | 4.7.1-r5 |
| alpine/xen(Alpine:v3.11) | < 4.7.1-r5 | 4.7.1-r5 |
| alpine/xen(Alpine:v3.12) | < 4.7.1-r5 | 4.7.1-r5 |
| alpine/xen(Alpine:v3.13) | < 4.7.1-r5 | 4.7.1-r5 |
| alpine/xen(Alpine:v3.14) | < 4.7.1-r5 | 4.7.1-r5 |
| alpine/xen(Alpine:v3.15) | < 4.7.1-r5 | 4.7.1-r5 |
| alpine/xen(Alpine:v3.16) | < 4.7.1-r5 | 4.7.1-r5 |
| alpine/xen(Alpine:v3.17) | < 4.7.1-r5 | 4.7.1-r5 |
| alpine/xen(Alpine:v3.18) | < 4.7.1-r5 | 4.7.1-r5 |
| alpine/xen(Alpine:v3.19) | < 4.7.1-r5 | 4.7.1-r5 |
| alpine/xen(Alpine:v3.20) | < 4.7.1-r5 | 4.7.1-r5 |
| alpine/xen(Alpine:v3.21) | < 4.7.1-r5 | 4.7.1-r5 |
| alpine/xen(Alpine:v3.22) | < 4.7.1-r5 | 4.7.1-r5 |
| alpine/xen(Alpine:v3.23) | < 4.7.1-r5 | 4.7.1-r5 |
| alpine/xen(Alpine:v3.24) | < 4.7.1-r5 | 4.7.1-r5 |
| alpine/xen(Alpine:v3.3) | < 4.6.3-r8 | 4.6.3-r8 |
| alpine/xen(Alpine:v3.4) | < 4.6.3-r10 | 4.6.3-r10 |
| alpine/xen(Alpine:v3.5) | < 4.7.1-r5 | 4.7.1-r5 |
| alpine/xen(Alpine:v3.6) | < 4.7.1-r5 | 4.7.1-r5 |
| alpine/xen(Alpine:v3.7) | < 4.7.1-r5 | 4.7.1-r5 |
| alpine/xen(Alpine:v3.8) | < 4.7.1-r5 | 4.7.1-r5 |
| alpine/xen(Alpine:v3.9) | < 4.7.1-r5 | 4.7.1-r5 |
| qemu display | All versions | No fix listed |
References
- Debian Security Tracker CVE-2017-2615 vendor-advisory
- RHSA-2017:0309 third-party-advisory vendor-advisory
- RHSA-2017:0328 third-party-advisory vendor-advisory
- RHSA-2017:0329 third-party-advisory vendor-advisory
- RHSA-2017:0330 third-party-advisory vendor-advisory
- RHSA-2017:0331 third-party-advisory vendor-advisory
- RHSA-2017:0332 third-party-advisory vendor-advisory
- RHSA-2017:0333 third-party-advisory vendor-advisory
- RHSA-2017:0334 third-party-advisory vendor-advisory
- RHSA-2017:0344 third-party-advisory vendor-advisory
- RHSA-2017:0350 third-party-advisory vendor-advisory
- RHSA-2017:0396 third-party-advisory vendor-advisory
- RHSA-2017:0454 third-party-advisory vendor-advisory
- [oss-security] 20170201 CVE-2017-2615 Qemu: display: cirrus: oob access while doing bitblt copy backward mode mailing-list third-party-advisory
- 95990 third-party-advisory vdb-entry
- 1037804 third-party-advisory vdb-entry
- bugzilla.redhat.com issue-tracking third-party-advisory
- [debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update mailing-list
- [qemu-devel] 20170201 [PATCH v3] cirrus: fix oob access issue (CVE-2017-2615) mailing-list patch third-party-advisory
- GLSA-201702-27 third-party-advisory vendor-advisory
- GLSA-201702-28 third-party-advisory vendor-advisory
- support.citrix.com third-party-advisory
- security.alpinelinux.org vendor-advisory
- bugs.debian.org issue-tracking