QEMU 'hw/input/ps2.c' Information Disclosure Vulnerability

Bugtraq ID:	101923
Class:	Input Validation Error
CVE:	CVE-2017-16845
Remote:	Yes
Local:	No
Published:	Nov 15 2017 12:00AM
Updated:	Dec 19 2017 10:37PM
Credit:	Cyrille Chatras of Orange.com.
Vulnerable:	Redhat OpenStack Platform 9.0 Redhat OpenStack Platform 8.0 (Liberty) Redhat OpenStack Platform 11 Redhat OpenStack Platform 10 Redhat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 Redhat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7 Redhat Enterprise Linux 7 QEMU QEMU 0
Not Vulnerable:

QEMU 'hw/input/ps2.c' Information Disclosure Vulnerability

QEMU is prone to an information-disclosure vulnerability.

Attackers can exploit this issue to obtain sensitive information that may aid in further attacks.

QEMU 'hw/input/ps2.c' Information Disclosure Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

QEMU 'hw/input/ps2.c' Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

QEMU 'hw/input/ps2.c' Information Disclosure Vulnerability

References:

• [Qemu-devel] [PATCH v2] ps2: check PS2Queue indices in post_load rou (Qemu)
  
• CVE-2017-16845 (Red Hat Bugzilla)
  
• QEMU Homepage (QEMU)
  
• Bug 1514148 - (CVE-2017-16845) CVE-2017-16845 Qemu: ps2: information leakage via (Red Hat Bugzilla)