CVE-2017-5898 Integer overflow in n/a

Medium 5.5 Published 15 Mar 2017 Updated 5 Aug 2024

Local users can crash QEMU via integer overflow in the CCID smartcard emulator, requiring specific build configuration.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2017-5898?

CVE-2017-5898 is a medium-severity vulnerability in Qemu Qemu, published on 15 Mar 2017. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Integer overflow in the emulated_apdu_from_guest function in usb/dev-smartcard-reader.c in Quick Emulator (Qemu), when built with the CCID Card device emulator support, allows local users to cause a denial of service (application crash) via a large Application Protocol Data Units (APDU) unit.

Weakness: CWE-190

Which versions are affected by CVE-2017-5898?

It affects 5 products.

Products include Qemu Qemu, Suse Linux Enterprise Desktop, Suse Linux Enterprise Server, Suse Linux Enterprise Server for Sap, Suse Linux Enterprise Software Development Kit.

How do I fix CVE-2017-5898?

Apply the vendor's patch.

Is CVE-2017-5898 being exploited?

There is no known exploitation of CVE-2017-5898 in the wild and no public exploit code.

All Qemu Qemu vulnerabilities

Sources

Also known as ALPINE-CVE-2017-5898, DEBIAN-CVE-2017-5898, GHSA-vfvm-h748-r758, UBUNTU-CVE-2017-5898.