Description
A stack-based buffer overflow vulnerability was found in NBD server implementation in qemu before 2.11 allowing a client to request an export name of size up to 4096 bytes, which in fact should be limited to 256 bytes, causing an out-of-bounds stack write in the qemu process. If NBD server requires TLS, the attacker cannot trigger the buffer overflow without first successfully negotiating TLS.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| QEMU | Qemu | 2.11 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | qemu | 1:2.11+dfsg-1 | — |
| Debian 13 | qemu | 1:2.11+dfsg-1 | — |
| Debian 12 | qemu | 1:2.11+dfsg-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | qemu-img-rhev +3 | 10:2.10.0-21.el7 | RHSA-2018:1104 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenStack 12 | qemu-img-rhev +3 | 10:2.10.0-21.el7 | RHSA-2018:1113 |
| Red Hat OpenStack 11 | qemu-img-rhev +3 | 10:2.10.0-21.el7 | RHSA-2018:1113 |
| Red Hat OpenStack 10 | qemu-img-rhev +3 | 10:2.10.0-21.el7 | RHSA-2018:1113 |
| Red Hat OpenStack 9 | qemu-img-rhev +3 | 10:2.10.0-21.el7 | RHSA-2018:1113 |
| Red Hat OpenStack 8 | qemu-img-rhev +3 | 10:2.10.0-21.el7 | RHSA-2018:1113 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | qemu | 6.1.0-32.1 | openSUSE-SU-2024:11287-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- QEMU - NBD Server Long Export Name Stack Buffer Overflow EDB-43194 · dos · Nov 29, 2017 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 3
- RHSA-2018:1113 Red Hat Security Advisory: qemu-kvm-rhev security and bug fix update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- RHSA-2018:1104 Red Hat Security Advisory: qemu-kvm-rhev security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jul 1, 2026
- openSUSE-SU-2024:11287-1 qemu-6.1.0-32.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15118
- RHSA-2018:1104 vendor-advisory
- https://lists.gnu.org/archive/html/qemu-devel/2017-11/msg05045.html
- USN-3575-1 vendor-advisory
- 101975 vdb-entry
- http://www.openwall.com/lists/oss-security/2017/11/28/8
- 43194 exploit