Bug 1489375 (CVE-2017-14167)
Summary: | CVE-2017-14167 Qemu: i386: multiboot OOB access while loading kernel image | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | Prasad Pandit <ppandit> |
Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
Status: | CLOSED ERRATA | QA Contact: | |
Severity: | medium | Docs Contact: | |
Priority: | medium | ||
Version: | unspecified | CC: | ailan, amit, apevec, areis, berrange, cfergeau, chrisw, cvsbot-xmlrpc, ddepaula, drjones, dwmw2, imammedo, itamar, jen, jforbes, jjoyce, jpadman, jschluet, kbasil, knoel, lhh, lpeer, markmc, m.a.young, mburns, mkenneth, mrezanin, mst, pbonzini, rbalakri, rbryant, rjones, rkrcmar, robinlee.sysu, sclewis, slinaber, srevivo, tdecacqu, virt-maint, virt-maint, vkuznets, xen-maint |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | Doc Type: | If docs needed, set a value | |
Doc Text: |
Quick Emulator (QEMU), compiled with the PC System Emulator with multiboot feature support, is vulnerable to an OOB r/w memory access issue. The issue could occur due to an integer overflow while loading a kernel image during a guest boot. A user or process could use this flaw to potentially achieve arbitrary code execution on a host.
|
Story Points: | --- |
Clone Of: | Environment: | ||
Last Closed: | 2018-03-22 07:37:14 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 1489376, 1501120, 1501121, 1501123, 1501124, 1501125, 1501126, 1501128, 1501129, 1501130, 1501131, 1502434 | ||
Bug Blocks: | 1489326, 1520687 |
Description
Prasad Pandit
2017-09-07 09:59:51 UTC
Acknowledgments: Name: Thomas Garnier (Google.com) Created qemu tracking bugs for this issue: Affects: fedora-all [bug 1489376] qemu-2.9.1-2.fc26 has been pushed to the Fedora 26 stable repository. If problems still persist, please make note of it in this bug report. This issue has been addressed in the following products: RHEV 4.X RHEV-H and Agents for RHEL-7 Via RHSA-2017:3369 https://access.redhat.com/errata/RHSA-2017:3369 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2017:3368 https://access.redhat.com/errata/RHSA-2017:3368 This issue has been addressed in the following products: Red Hat OpenStack Platform 8.0 (Liberty) Via RHSA-2017:3471 https://access.redhat.com/errata/RHSA-2017:3471 This issue has been addressed in the following products: Red Hat OpenStack Platform 9.0 (Mitaka) Via RHSA-2017:3470 https://access.redhat.com/errata/RHSA-2017:3470 This issue has been addressed in the following products: Red Hat OpenStack Platform 11.0 (Ocata) Via RHSA-2017:3466 https://access.redhat.com/errata/RHSA-2017:3466 This issue has been addressed in the following products: Red Hat OpenStack Platform 10.0 (Newton) Via RHSA-2017:3474 https://access.redhat.com/errata/RHSA-2017:3474 This issue has been addressed in the following products: Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 Via RHSA-2017:3472 https://access.redhat.com/errata/RHSA-2017:3472 This issue has been addressed in the following products: Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7 Via RHSA-2017:3473 https://access.redhat.com/errata/RHSA-2017:3473 |