Skip to content
OpenAdvisories
Unscored Public exploit CVE-2018-12617 EUVD-2018-4573GHSA-prpr-q2gp-hgw2

qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in QEMU 2.12.50 has an integer overf…

Published Jun 21, 2018 · Updated Aug 5, 2024 · Assigned by mitre

Package: qemu Package: qemu Ecosystem: Debian Ecosystem: Ubuntu

Description

qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in QEMU 2.12.50 has an integer overflow causing a g_malloc0() call to trigger a segmentation fault when trying to allocate a large memory chunk. The vulnerability can be exploited by sending a crafted QMP command (including guest-file-read with a large count value) to the agent via the listening socket.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 qemu 1:3.1+dfsg-1 —
Debian 13 qemu 1:3.1+dfsg-1 —
Debian 12 qemu 1:3.1+dfsg-1 —
Debian 9 qemu 1:2.8+dfsg-6+deb9u6 DSA-4454-1
Debian 8 qemu 1:2.1+dfsg-12+deb8u10 DLA-1694-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 18.04 LTS qemu 1:2.11+dfsg-1ubuntu7.8 USN-3826-1
Ubuntu 16.04 LTS qemu 1:2.5+dfsg-5ubuntu10.33 USN-3826-1
Ubuntu 14.04 LTS qemu 2.0.0+dfsg-2ubuntu1.44 USN-3826-1

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 qemu 2.11.2-9.9.1 SUSE-SU-2018:2679-1
SLES 12 SP3 qemu 2.9.1-6.19.11 SUSE-SU-2018:3555-1
SLES 12 SP2 qemu 2.6.2-41.43.3 SUSE-SU-2018:2973-2, SUSE-SU-2018:2973-1
SLES 12 SP1 qemu 2.3.1-33.12.1 SUSE-SU-2018:2565-1
SLES 12 SP1 xen 4.5.5_24-22.52.3 SUSE-SU-2018:2069-1
SLES 12 qemu 2.0.2-48.43.3 SUSE-SU-2018:2556-1
SLES 12 xen 4.4.4_34-22.71.2 SUSE-SU-2018:2056-1
Show 9 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES 11 SP4 kvm 1.4.2-60.15.2 SUSE-SU-2018:2650-1
SLES 11 SP4 xen 4.4.4_34-61.32.1 SUSE-SU-2018:2037-1
SLES 11 SP3 kvm 1.4.2-53.23.2 SUSE-SU-2018:2615-1
SLES 11 SP3 xen 4.2.5_21-45.25.1 SUSE-SU-2018:2528-1
SLES for SAP 12 SP3 qemu 2.9.1-6.19.11 SUSE-SU-2018:3555-1
SLES for SAP 12 SP2 qemu 2.6.2-41.43.3 SUSE-SU-2018:2973-1
SLES for SAP 12 SP1 qemu 2.3.1-33.12.1 SUSE-SU-2018:2565-1
SLES for SAP 12 SP1 xen 4.5.5_24-22.52.3 SUSE-SU-2018:2069-1
SLES for SAP 11 SP4 kvm 1.4.2-60.15.2 SUSE-SU-2018:2650-1
SLES for SAP 11 SP4 xen 4.4.4_34-61.32.1 SUSE-SU-2018:2037-1
SUSE OpenStack Cloud 7 qemu 2.6.2-41.43.3 SUSE-SU-2018:2973-1
SUSE Linux Enterprise Point of Sale 11 SP3 kvm 1.4.2-53.23.2 SUSE-SU-2018:2615-1
SUSE Linux Enterprise Point of Sale 11 SP3 xen 4.2.5_21-45.25.1 SUSE-SU-2018:2528-1
SUSE Enterprise Storage 4 qemu 2.6.2-41.43.3 SUSE-SU-2018:2973-1

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 7 ivshmem-tools +2 15:3.0.0-1.el7 ELSA-2019-4585, ELSA-2018-4285
Oracle Linux 7 qemu +9 12:2.9.0-17.el7 ELSA-2019-4585, ELSA-2018-4289, ELSA-2018-4285

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Exploit-DB 1

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 20

References