CVE-2017-2620

NameCVE-2017-2620
DescriptionQuick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
ReferencesDLA-1270-1, DLA-1497-1, DLA-842-1, DLA-845-1
NVD severityhigh (attack range: remote)
Debian Bugs855791

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
qemu (PTS)jessie1:2.1+dfsg-12+deb8u6vulnerable
jessie (security)1:2.1+dfsg-12+deb8u12fixed
stretch (security), stretch1:2.8+dfsg-6+deb9u8fixed
buster1:3.1+dfsg-8~deb10u1fixed
buster (security)1:3.1+dfsg-8+deb10u2fixed
bullseye, sid1:4.1-1fixed
xen (PTS)jessie4.4.1-9+deb8u10fixed
jessie (security)4.4.4lts5-0+deb8u1fixed
stretch (security), stretch4.8.5+shim4.10.2+xsa282-1+deb9u11fixed
buster, bullseye, sid4.11.1+92-g6c33308a8d-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
qemusource(unstable)1:2.8+dfsg-3high855791
qemusourcejessie1:2.1+dfsg-12+deb8u7highDLA-1497-1
qemusourcewheezy1.1.2+dfsg-6+deb7u20highDLA-845-1
qemu-kvmsource(unstable)(unfixed)high
qemu-kvmsourcewheezy1.1.2+dfsg-6+deb7u20highDLA-842-1
xensource(unstable)4.4.0-1high
xensourcewheezy4.1.6.lts1-12highDLA-1270-1

Notes

Xen switched to qemu-system in 4.4.0-1
https://xenbits.xen.org/xsa/advisory-209.html
Qemu upstream patch: https://lists.gnu.org/archive/html/qemu-devel/2017-02/msg04700.html

Search for package or bug name: Reporting problems