QEMU 'hw/display/vga.c' Denial of Service Vulnerability

Bugtraq ID:	100540
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2017-13672
Remote:	Yes
Local:	No
Published:	Aug 30 2017 12:00AM
Updated:	May 02 2018 12:00PM
Credit:	David Buchanan
Vulnerable:	Redhat Virtualization 4 Redhat RHEV-M for Servers 0 Redhat OpenStack Platform 9.0 Redhat OpenStack Platform 8.0 (Liberty) Redhat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 Redhat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7 Redhat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6 Redhat Enterprise Linux 7 Redhat Enterprise Linux 6 + Trustix Secure Enterprise Linux 2.0 + Trustix Secure Linux 2.2 + Trustix Secure Linux 2.1 + Trustix Secure Linux 2.0 Redhat Enterprise Linux 5 QEMU QEMU 0 Oracle Linux 7.0 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64
Not Vulnerable:

QEMU 'hw/display/vga.c' Denial of Service Vulnerability

QEMU is prone to a denial-of-service vulnerability.

Attackers can exploit this issue to crash the Qemu process on the host, denying service to legitimate users.

QEMU 'hw/display/vga.c' Denial of Service Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

QEMU 'hw/display/vga.c' Denial of Service Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

QEMU 'hw/display/vga.c' Denial of Service Vulnerability

References:

• [Qemu-devel] [PATCH] vga: stop passing pointers to vga_draw_line* function (GNU)
  
• QEMU Homepage (QEMU)
  
• Bug 1486560 CVE-2017-13672 Qemu: vga: OOB read access during display update (Redhat)
  
• CVE-2017-13672 (Redhat)
  
• Oracle Linux Bulletin - April 2018 (Oracle)