Vulnerability CVE-2017-15038
Published: 2017-10-09   Modified: 2017-10-10

Description:
Race condition in the v9fs_xattrwalk function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS users to obtain sensitive information from host heap memory via vectors related to reading extended attributes.

Type:

CWE-362

CVSS2 => (AV:L/AC:M/Au:N/C:P/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
1.9/10
2.9/10
3.4/10
Exploit range
Attack complexity
Authentication
Local
Medium
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
None
None
Affected software
QEMU -> QEMU 

 References:
http://www.openwall.com/lists/oss-security/2017/10/06/1
https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
https://lists.gnu.org/archive/html/qemu-devel/2017-10/msg00729.html
https://usn.ubuntu.com/3575-1/
https://www.debian.org/security/2018/dsa-4213
Copyright 2024, cxsecurity.com

 

Back to Top