CVE-2017-5931
HighSummary
Integer overflow in hw/virtio/virtio-crypto.c in QEMU allows local guest OS privileged users to cause a denial of service (QEMU process crash) or possibly execute arbitrary code on the host via a crafted virtio-crypto request, triggering a heap-based buffer overflow.
Risk Assessment
This vulnerability may lead to a crash of the QEMU system, affecting the availability of virtualization services. There is also a risk of executing arbitrary code on the host, which could lead to serious security breaches.
Recommendation
It is recommended to update QEMU to the latest version where this vulnerability has been patched. Additionally, monitor and restrict access to virtual systems to minimize the risk of exploitation.
Other vulnerabilities in QEMU (Quick Emulator)
See all- CVE-2017-14167High
Integer overflow in the load_multiboot function in QEMU allows local guest OS users to execute arbitrary code on the host via crafted multiboot header address values, triggering an out-of-bounds write.
- CVE-2017-6058High
Buffer overflow in NetRxPkt::ehdr_buf in QEMU when the VLANSTRIP feature is enabled on the vmxnet3 device allows remote attackers to cause a denial of service via out-of-bounds access, leading to a QEMU process crash.
Original NVD description (English source)
Integer overflow in hw/virtio/virtio-crypto.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (QEMU process crash) or possibly execute arbitrary code on the host via a crafted virtio-crypto request, which triggers a heap-based buffer overflow.