CVE-2017-2630 Memory corruption in Qemu:
A malicious NBD server can trigger a stack buffer overflow in QEMU, leading to denial of service or arbitrary code execution on the client host.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-2630?
CVE-2017-2630 is a medium-severity memory corruption vulnerability in Qemu Qemu, published on 27 Jul 2018. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A stack buffer overflow flaw was found in the Quick Emulator (QEMU) before 2.9 built with the Network Block Device (NBD) client support. The flaw could occur while processing server's response to a 'NBD_OPT_LIST' request. A malicious NBD server could use this issue to crash a remote NBD client resulting in DoS or potentially execute arbitrary code on client host with privileges of the QEMU process.
Which versions are affected by CVE-2017-2630?
It affects 1 product.
Products include Qemu Qemu.
How do I fix CVE-2017-2630?
Upgrade to a fixed version.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2017-2630 being exploited?
There is no known exploitation of CVE-2017-2630 in the wild and no public exploit code.
Other vulnerabilities in Qemu Qemu
Sources
Also known as DEBIAN-CVE-2017-2630, GHSA-2rf9-cmpf-qww5.