CVE-2017-15038 Race condition in n/a

Medium 5.6 Published 9 Oct 2017 Updated 5 Aug 2024

Local guest users can exploit a race condition in QEMU's 9pfs implementation to read sensitive host heap memory.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2017-15038?

CVE-2017-15038 is a medium-severity vulnerability in Qemu Qemu, published on 9 Oct 2017. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Race condition in the v9fs_xattrwalk function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS users to obtain sensitive information from host heap memory via vectors related to reading extended attributes.

Weakness: CWE-362

Which versions are affected by CVE-2017-15038?

It affects 1 product.

Products include Qemu Qemu.

How do I fix CVE-2017-15038?

Apply the vendor's patch.

Is CVE-2017-15038 being exploited?

There is no known exploitation of CVE-2017-15038 in the wild and no public exploit code.

All Qemu Qemu vulnerabilities

Sources

Also known as DEBIAN-CVE-2017-15038, GHSA-wvr5-3fwj-8f26, UBUNTU-CVE-2017-15038.