CVE-2017-17381

Summary

CVE	CVE-2017-17381
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2017-12-07 02:29:00 UTC
Updated	2020-11-10 18:19:00 UTC
Description	The Virtio Vring implementation in QEMU allows local OS guest users to cause a denial of service (divide-by-zero error and QEMU process crash) by unsetting vring alignment while updating Virtio rings.

Risk And Classification

Problem Types: CWE-369

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Operating System	Debian	Debian Linux	9.0	All	All	All
Operating System	Debian	Debian Linux	9.0	All	All	All
Application	Qemu	Qemu	2.11.0	rc0	All	All
Application	Qemu	Qemu	2.11.0	rc1	All	All
Application	Qemu	Qemu	2.11.0	rc2	All	All
Application	Qemu	Qemu	2.11.0	rc3	All	All
Application	Qemu	Qemu	2.11.0	rc0	All	All
Application	Qemu	Qemu	2.11.0	rc1	All	All
Application	Qemu	Qemu	2.11.0	rc2	All	All
Application	Qemu	Qemu	2.11.0	rc3	All	All
Application	Qemu	Qemu	All	All	All	All

References

Reference	Source	Link	Tags
USN-3575-1: QEMU vulnerabilities \| Ubuntu security notices	UBUNTU	usn.ubuntu.com	Third Party Advisory
oss-security - CVE-2017-17381 Qemu: virtio: divide by zero exception while updating rings	MLIST	www.openwall.com	Mailing List, Third Party Advisory
Debian -- Security Information -- DSA-4213-1 qemu	DEBIAN	www.debian.org	Third Party Advisory
QEMU CVE-2017-17381 Denial of Service Vulnerability	BID	www.securityfocus.com	Third Party Advisory, VDB Entry
[Qemu-devel] [PULL 6/7] virtio: check VirtQueue Vring object is set	MLIST	lists.gnu.org	Issue Tracking, Third Party Advisory
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Legacy QID Mappings

900063 CBL-Mariner Linux Security Update for qemu-kvm 4.2.0