CVE-2017-8284 Code injection in n/a
Local attackers can inject code into setuid programs via QEMU's TCG mode, leading to privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-8284?
CVE-2017-8284 is a high-severity code injection vulnerability in Qemu Qemu, published on 26 Apr 2017. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The disas_insn function in target/i386/translate.c in QEMU before 2.9.0, when TCG mode without hardware acceleration is used, does not limit the instruction size, which allows local users to gain privileges by creating a modified basic block that injects code into a setuid program, as demonstrated by procmail. NOTE: the vendor has stated "this bug does not violate any security guarantees QEMU makes.
Weakness: CWE-94
Which versions are affected by CVE-2017-8284?
It affects 1 product.
Products include Qemu Qemu.
How do I fix CVE-2017-8284?
Upgrade to a fixed version.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2017-8284 being exploited?
There is no known exploitation of CVE-2017-8284 in the wild and no public exploit code.
Other vulnerabilities in Qemu Qemu
Sources
Also known as DEBIAN-CVE-2017-8284, GHSA-rw7x-4625-rjj4, UBUNTU-CVE-2017-8284.