Tracker / CVE-2017-2620
CVE-2017-2620
Medium 5.5
Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process.
Affected products and versions
| citrix | xenserver |
|---|---|
| debian | debian_linux |
| qemu | qemu · … → 2.8.0 |
| redhat | enterprise_linux_desktop |
| redhat | enterprise_linux_server |
| redhat | enterprise_linux_server_aus |
| redhat | enterprise_linux_server_eus |
| redhat | enterprise_linux_workstation |
| redhat | openstack |
| xen | xen |
| xen | xen · … → 4.7.1 |
Analysis
This page is not indexable yet.Until it carries original analysis — what it actually exposes, how to check in two minutes whether a system was touched, what to do if it was — the page stays noindex. The database decides that, not the template.