CVE-2015-5745 Memory corruption in QEMU

Medium 6.5 Published 23 Jan 2020 Updated 6 Aug 2024

A buffer overflow in QEMU allows guest users to crash the QEMU process via a crafted virtio control message, causing denial of service.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2015-5745?

CVE-2015-5745 is a medium-severity memory corruption vulnerability in Fedoraproject Fedora, published on 23 Jan 2020. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Buffer overflow in the send_control_msg function in hw/char/virtio-serial-bus.c in QEMU before 2.4.0 allows guest users to cause a denial of service (QEMU process crash) via a crafted virtio control message.

Weakness: CWE-120

Which versions are affected by CVE-2015-5745?

It affects 3 products.

Products include Arista Eos, Fedoraproject Fedora, Qemu Qemu.

How do I fix CVE-2015-5745?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2015-5745 being exploited?

There is no known exploitation of CVE-2015-5745 in the wild and no public exploit code.

All Fedoraproject Fedora vulnerabilities

Sources

Also known as DEBIAN-CVE-2015-5745, GHSA-w8v5-w883-3mh3, UBUNTU-CVE-2015-5745.