Critical severity · published Jul 3, 2018
CVE-2017-2615
Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue
9.1
CVSS
3.6%
EPSS
No
On KEV
Description
Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue. It could occur while copying VGA data via bitblt copy in backward mode. A privileged user inside a guest could use this flaw to crash the QEMU process resulting in DoS or potentially execute arbitrary code on the host with privileges of QEMU process on the host.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)3.6% · higher than 90% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DL
Debian Linux · Debian
7.0 · source: NVD
EL
Enterprise Linux Desktop · Redhat
6.0; 7.0 · source: NVD
EL
Enterprise Linux Server · Redhat
6.0; 7.0 · source: NVD
EL
Enterprise Linux Server Aus · Redhat
7.3; 7.4 · source: NVD
EL
Enterprise Linux Server Eus · Redhat
7.3; 7.4; 7.5 · source: NVD
EL
Enterprise Linux Workstation · Redhat
6.0; 7.0 · source: NVD
OP
Openstack · Redhat
5.0; 6.0; 7.0; 8; 9; 10 · source: NVD
QE
Qemu · Qemu
through 2.8.0 · source: NVD
XE
Xen · Xen
through 4.7.1; 4.7.1; 4.7.1; 4.7.1; 4.7.1 · source: NVD
XE
Xenserver · Citrix
6.0.2; 6.2.0; 6.5; 7.0; 7.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-2615
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-2615
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-0309.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-0328.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-0329.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-0330.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-0331.html
Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2017-0332.html
More from Xenserver
9.9
CVE-2016-9603
A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support before 2.9; the issue could occur when a VNC client attempted to update…
9.9
CVE-2017-2620
Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue
9.8
CVE-2018-14007
Citrix XenServer 7.1 and newer allows Directory Traversal
9.8
CVE-2015-7705
The rate limiting feature in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to have unspecified impact via a large number of crafted requests
9.8
CVE-2016-5302
Citrix XenServer 7.0 before Hotfix XS70E003, when a deployment has been upgraded from an earlier release, might allow remote attackers on the management network to "compromise" a…