CVE-2018-7550

HIGH

8.8

Description

The load_multiboot function in hw/i386/multiboot.c in Quick Emulator (aka QEMU) allows local guest OS users to execute arbitrary code on the QEMU host via a mh_load_end_addr value greater than mh_bss_end_addr, which triggers an out-of-bounds read or write memory access.

CVE Details

CVSS v3.1 Score8.8

SeverityHIGH

CVSS VectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack VectorLOCAL

ComplexityLOW

Privileges RequiredLOW

User InteractionNONE

Published3/1/2018

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

canonical:ubuntu_linuxdebian:debian_linuxqemu:qemuredhat:enterprise_linux_desktopredhat:enterprise_linux_serverredhat:enterprise_linux_server_ausredhat:enterprise_linux_server_eusredhat:enterprise_linux_server_tusredhat:enterprise_linux_workstation

Weaknesses (CWE)

CWE-125CWE-787

References

http://www.securityfocus.com/bid/103181(cve@mitre.org)

https://access.redhat.com/errata/RHSA-2018:1369(cve@mitre.org)

https://access.redhat.com/errata/RHSA-2018:2462(cve@mitre.org)

https://bugzilla.redhat.com/show_bug.cgi?id=1549798(cve@mitre.org)

https://github.com/orangecertcc/security-research/security/advisories/GHSA-f49v-45qp-cv53(cve@mitre.org)

https://lists.debian.org/debian-lts-announce/2018/04/msg00015.html(cve@mitre.org)

https://lists.debian.org/debian-lts-announce/2018/04/msg00016.html(cve@mitre.org)

https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html(cve@mitre.org)

https://lists.gnu.org/archive/html/qemu-devel/2018-02/msg06890.html(cve@mitre.org)

https://usn.ubuntu.com/3649-1/(cve@mitre.org)

https://www.debian.org/security/2018/dsa-4213(cve@mitre.org)

http://www.securityfocus.com/bid/103181(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2018:1369(af854a3a-2127-422b-91ae-364da2661108)

https://access.redhat.com/errata/RHSA-2018:2462(af854a3a-2127-422b-91ae-364da2661108)

https://bugzilla.redhat.com/show_bug.cgi?id=1549798(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/orangecertcc/security-research/security/advisories/GHSA-f49v-45qp-cv53(af854a3a-2127-422b-91ae-364da2661108)

https://lists.debian.org/debian-lts-announce/2018/04/msg00015.html(af854a3a-2127-422b-91ae-364da2661108)

https://lists.debian.org/debian-lts-announce/2018/04/msg00016.html(af854a3a-2127-422b-91ae-364da2661108)

https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html(af854a3a-2127-422b-91ae-364da2661108)

https://lists.gnu.org/archive/html/qemu-devel/2018-02/msg06890.html(af854a3a-2127-422b-91ae-364da2661108)

https://usn.ubuntu.com/3649-1/(af854a3a-2127-422b-91ae-364da2661108)

https://www.debian.org/security/2018/dsa-4213(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.