Qemu 'hw/display/cirrus_vga.c' Remote Code Execution Vulnerability
BID:97955
Info
Qemu 'hw/display/cirrus_vga.c' Remote Code Execution Vulnerability
| Bugtraq ID: | 97955 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2017-7980 |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 21 2017 12:00AM |
| Updated: | May 15 2019 04:00PM |
| Credit: | Jiangxin of PSIRT Huawei Inc. and Li Qiang of 360.cn Inc. |
| Vulnerable: |
Redhat OpenStack Platform 9.0 Redhat OpenStack Platform 8.0 (Liberty) Redhat OpenStack Platform 10 Redhat Enterprise Linux Workstation 7 Redhat Enterprise Linux Server 7 Redhat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 Redhat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7 Redhat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 6 Redhat Enterprise Linux ComputeNode Optional 7 Redhat Enterprise Linux 7 Client Redhat Enterprise Linux 7 Redhat Enterprise Linux 6 QEMU QEMU 0 Oracle Enterprise Linux 7 openSUSE Leap 42.2 Gentoo Linux Citrix XenServer 6.0.2 Citrix XenServer 7.2 Citrix XenServer 7.1 LTSR CU1 Citrix XenServer 7.1 Citrix XenServer 7.0 Citrix XenServer 6.5 Citrix XenServer 6.2 CentOS CentOS 7 |
| Not Vulnerable: |
Citrix XenServer 6.0.2 Common Criteria Citrix XenServer 6.5 Service Pack 1 Citrix XenServer 6.2 Service Pack 1 |
Discussion
Qemu 'hw/display/cirrus_vga.c' Remote Code Execution Vulnerability
Qemu is prone to a remote code-execution vulnerability.
Attackers can exploit this issue to execute arbitrary code with privileges of the QEMU process. Failed exploit attempts will result in a denial-of-service condition.
Qemu is prone to a remote code-execution vulnerability.
Attackers can exploit this issue to execute arbitrary code with privileges of the QEMU process. Failed exploit attempts will result in a denial-of-service condition.
Exploit / POC
Qemu 'hw/display/cirrus_vga.c' Remote Code Execution Vulnerability
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
Qemu 'hw/display/cirrus_vga.c' Remote Code Execution Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
Qemu 'hw/display/cirrus_vga.c' Remote Code Execution Vulnerability
References:
References: