CVE-2017-2630

MEDIUM

QEMU < 2.9 - Stack Buffer Overflow via NBD_OPT_LIST Response Processing

Title source: llm
STIX 2.1

Description

A stack buffer overflow flaw was found in the Quick Emulator (QEMU) before 2.9 built with the Network Block Device (NBD) client support. The flaw could occur while processing server's response to a 'NBD_OPT_LIST' request. A malicious NBD server could use this issue to crash a remote NBD client resulting in DoS or potentially execute arbitrary code on client host with privileges of the QEMU process.

References (8)

Core 8
Core References
Third Party Advisory vendor-advisory x_refsource_redhat
https://access.redhat.com/errata/RHSA-2017:2392
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/96265
Third Party Advisory vendor-advisory x_refsource_gentoo
https://security.gentoo.org/glsa/201704-01
Mailing List, Patch, Third Party Advisory mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2017/02/15/2
Patch, Third Party Advisory mailing-list x_refsource_mlist
https://lists.gnu.org/archive/html/qemu-devel/2017-02/msg01246.html
Issue Tracking, Patch, Third Party Advisory x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2630
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=1422415

Scores

CVSS v3 5.5
EPSS 0.0113
EPSS Percentile 78.6%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L

Details

CWE
CWE-119 CWE-121
Status published
Products (1)
qemu/qemu < 2.9
Published Jul 27, 2018
Tracked Since Feb 18, 2026