CVE-2017-2630
- State
- Published
- Severity
- 5.5 Medium
- Published
- Jul 27, 2018
- Updated
- Aug 5, 2024
- Reserved
- Dec 1, 2016
Description
A stack buffer overflow flaw was found in the Quick Emulator (QEMU) before 2.9 built with the Network Block Device (NBD) client support. The flaw could occur while processing server's response to a 'NBD_OPT_LIST' request. A malicious NBD server could use this issue to crash a remote NBD client resulting in DoS or potentially execute arbitrary code on client host with privileges of the QEMU process.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 5.5 Medium | CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L | redhat |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
Qemu:QEMU |
|
References
- RHSA-2017:2392vendor-advisory
- 96265vdb-entry
- GLSA-201704-01vendor-advisory
- [oss-security] 20170215 CVE-2017-2630 Qemu: nbd: oob stack write in client routine drop_syncmailing-list
- [qemu-devel] 20170206 [PATCH 05/18] nbd/client: fix drop_syncmailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2630
- https://bugzilla.redhat.com/show_bug.cgi?id=1422415
- https://github.com/qemu/qemu/commit/2563c9c6b8670400c48e562034b321a7cf3d9a85
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.