CVE-2017-8284
HighSummary
The disas_insn function in QEMU before version 2.9.0 does not limit instruction size in TCG mode without hardware acceleration, allowing local users to gain privileges by creating a modified basic block that injects code into a setuid program.
Risk Assessment
Local users can exploit this vulnerability to gain elevated privileges, posing a serious security risk to the system.
Recommendation
It is recommended to update QEMU to version 2.9.0 or later to mitigate this vulnerability.
Other vulnerabilities in QEMU
See all- CVE-2015-7504High
Heap-based buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU allows guest OS administrators to cause a denial of service (instance crash) or possibly execute arbitrary code via a series of packets in loopback mode.
- CVE-2017-15268High
Qemu through 2.10.0 allows remote attackers to cause a memory leak by triggering slow data-channel read operations, related to io/channel-websock.c.
- CVE-2017-13711High
A use-after-free vulnerability in the sofree function in slirp/socket.c in QEMU allows attackers to cause a denial of service (QEMU instance crash) by failing to properly clear ifq_so from pending packets.
- CVE-2014-0145High
Multiple buffer overflows in QEMU before 1.7.2 and 2.x before 2.0.0 allow local users to cause a denial of service (crash) or possibly execute arbitrary code via a large L1 table in the qcow2_snapshot_load_tmp in the QCOW 2 block driver or various parameters in the DMG block driver.
- CVE-2014-0143High
Multiple integer overflows in QEMU, before version 2.0.0, allow local users to cause a denial of service (crash) by providing crafted input, leading to buffer overflows and memory corruption.
- CVE-2017-10664High
qemu-nbd in QEMU does not ignore SIGPIPE, allowing remote attackers to cause a denial of service (daemon crash) by disconnecting during a server-to-client reply attempt.
- CVE-2017-8309High
A memory leak in audio/audio.c in QEMU allows remote attackers to cause a denial of service by repeatedly starting and stopping audio capture.
- CVE-2015-8619High
The Human Monitor Interface support in QEMU allows remote attackers to cause a denial of service through out-of-bounds write and application crash.
- CVE-2015-8567High
A memory leak in QEMU's net/vmxnet3.c allows remote attackers to cause a denial of service through excessive memory consumption.
- CVE-2015-8666High
A heap-based buffer overflow exists in QEMU when built with the Q35-chipset-based PC system emulator. This vulnerability may lead to unauthorized memory access.
Original NVD description (English source)
The disas_insn function in target/i386/translate.c in QEMU before 2.9.0, when TCG mode without hardware acceleration is used, does not limit the instruction size, which allows local users to gain privileges by creating a modified basic block that injects code into a setuid program, as demonstrated by procmail. NOTE: the vendor has stated "this bug does not violate any security guarantees QEMU makes.