CVE-2018-12617

HIGH

QEMU Guest Agent <2.12.50 - Memory Corruption

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2018-12617. PoCs published by Fakhri Zulkifli.

AI-analyzed exploit summary This exploit demonstrates a denial-of-service vulnerability in QEMU Guest Agent 2.12.50 and earlier by triggering an integer overflow in the `guest-file-read` QMP command, leading to a segmentation fault due to an invalid memory allocation.

Description

qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in QEMU 2.12.50 has an integer overflow causing a g_malloc0() call to trigger a segmentation fault when trying to allocate a large memory chunk. The vulnerability can be exploited by sending a crafted QMP command (including guest-file-read with a large count value) to the agent via the listening socket.

Exploits (1)

exploitdb WORKING POC

by Fakhri Zulkifli · textdoslinux

https://www.exploit-db.com/exploits/44925

View Code ZIP pw:eip

This exploit demonstrates a denial-of-service vulnerability in QEMU Guest Agent 2.12.50 and earlier by triggering an integer overflow in the `guest-file-read` QMP command, leading to a segmentation fault due to an invalid memory allocation.

Classification

Working Poc 90%

Attack Type

Dos

Complexity

Trivial

Reliability

Reliable

Target: QEMU Guest Agent 2.12.50 and earlier

No auth needed

Prerequisites: Access to the QEMU Guest Agent UNIX socket · QEMU Guest Agent running with vulnerable version

MITRE ATT&CK