CVE-2018-16847 Memory corruption in QEMU:

High 7.0 Published 2 Nov 2018 Updated 5 Aug 2024

A guest user can trigger an out-of-bounds heap buffer access in QEMU's NVMe emulation, leading to denial of service or arbitrary code execution.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2018-16847?

CVE-2018-16847 is a high-severity memory corruption vulnerability in Canonical Ubuntu Linux, published on 2 Nov 2018. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

An OOB heap buffer r/w access issue was found in the NVM Express Controller emulation in QEMU. It could occur in nvme_cmb_ops routines in nvme device. A guest user/process could use this flaw to crash the QEMU process resulting in DoS or potentially run arbitrary code with privileges of the QEMU process.

Weakness: CWE-125, CWE-787

Which versions are affected by CVE-2018-16847?

It affects 2 products.

Linux distribution packages (2)

`qemu` SUSE:Linux Enterprise Module for Basesystem 15	All versions	`2.11.2-9.17.1`
`qemu` SUSE:Linux Enterprise Module for Server Applications 15	All versions	`2.11.2-9.17.1`

Products include Canonical Ubuntu Linux, Qemu Qemu.

How do I fix CVE-2018-16847?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2018-16847 being exploited?

There is no known exploitation of CVE-2018-16847 in the wild and no public exploit code.

All Canonical Ubuntu Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2018-16847, GHSA-pxrw-p8g9-545p, SUSE-SU-2018:4086-1, UBUNTU-CVE-2018-16847.