CVE-2014-0145 Memory corruption in n/a
Local attackers can trigger buffer overflows in QEMU's QCOW2 and DMG drivers to crash the system or execute arbitrary code.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-0145?
CVE-2014-0145 is a high-severity memory corruption vulnerability in Qemu Qemu, published on 10 Aug 2017. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
Multiple buffer overflows in QEMU before 1.7.2 and 2.x before 2.0.0, allow local users to cause a denial of service (crash) or possibly execute arbitrary code via a large (1) L1 table in the qcow2_snapshot_load_tmp in the QCOW 2 block driver (block/qcow2-snapshot.c) or (2) uncompressed chunk, (3) chunk length, or (4) number of sectors in the DMG block driver (block/dmg.c).
Weakness: CWE-119
Which versions are affected by CVE-2014-0145?
It affects 1 product.
Products include Qemu Qemu.
How do I fix CVE-2014-0145?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2014-0145 being exploited?
There is no known exploitation of CVE-2014-0145 in the wild and no public exploit code.
Other vulnerabilities in Qemu Qemu
Sources
Also known as DEBIAN-CVE-2014-0145, GHSA-cc9p-3fx3-m352.