Description
The host_from_stream_offset function in arch_init.c in QEMU, when loading RAM during migration, allows remote attackers to execute arbitrary code via a crafted (1) offset or (2) length value in savevm data.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | qemu | 2.1+dfsg-8 | — |
| Debian 13 | qemu | 2.1+dfsg-8 | — |
| Debian 12 | qemu | 2.1+dfsg-8 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | qemu | 2.0.0+dfsg-2ubuntu1.9 | USN-2439-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | qemu-img +6 | 10:1.5.3-86.el7 | RHSA-2015:0349 |
| RHEL 7 | qemu-img-rhev +6 | 10:2.1.2-23.el7 | RHSA-2015:0624 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 | qemu | 2.0.2-42.1 | SUSE-SU-2015:0349-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 | qemu | 2.0.2-42.1 | SUSE-SU-2015:0349-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | qemu-img +6 | 10:1.5.3-86.el7 | ELSA-2015-0349 |
Advisories 5
- RHSA-2015:0349 Red Hat Security Advisory: qemu-kvm security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- RHSA-2015:0624 Red Hat Security Advisory: qemu-kvm-rhev security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- USN-2439-1 qemu, qemu-kvm vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- SUSE-SU-2015:0349-1 Security update for qemu SUSE / openSUSE Security Updates · Feb 4, 2026
- ELSA-2015-0349 Important: qemu-kvm security, bug fix, and enhancement update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Mar 11, 2015
References
- RHSA-2015:0624 vendor-advisory
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=0be839a2701369f669532ea5884c15bead1c6e08
- [qemu-devel] 20141112 [PATCH 0/4] migration: fix CVE-2014-7840 mailing-list
- RHSA-2015:0349 vendor-advisory
- qemu-cve20147840-code-exec(99194) vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=1163075