CVE-2017-14167
HighSummary
Integer overflow in the load_multiboot function in QEMU allows local guest OS users to execute arbitrary code on the host via crafted multiboot header address values, triggering an out-of-bounds write.
Risk Assessment
This vulnerability may lead to remote code execution on the host, posing a serious threat to the security of the system and the organization's data.
Recommendation
It is recommended to update QEMU to the latest version to mitigate this vulnerability and to monitor systems for potential exploitation attempts.
Other vulnerabilities in QEMU (Quick Emulator)
See all- CVE-2017-5931High
Integer overflow in hw/virtio/virtio-crypto.c in QEMU allows local guest OS privileged users to cause a denial of service (QEMU process crash) or possibly execute arbitrary code on the host via a crafted virtio-crypto request, triggering a heap-based buffer overflow.
- CVE-2017-6058High
Buffer overflow in NetRxPkt::ehdr_buf in QEMU when the VLANSTRIP feature is enabled on the vmxnet3 device allows remote attackers to cause a denial of service via out-of-bounds access, leading to a QEMU process crash.
Original NVD description (English source)
Integer overflow in the load_multiboot function in hw/i386/multiboot.c in QEMU (aka Quick Emulator) allows local guest OS users to execute arbitrary code on the host via crafted multiboot header address values, which trigger an out-of-bounds write.