Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process.
| CVE | CVE-2017-2620 |
|---|---|
| Severidad | MEDIUM |
| CVSS | 5.5 / 10 |
| EPSS | 3.6% en 30 días (percentil 89) |
| CWE | CWE-125, CWE-787 |
| Exposición (Shodan) | sin hosts expuestos detectados actualmente |
Productos afectados (catálogo NVD)
citrix/xenserverdebian/debian_linuxqemu/qemuredhat/enterprise_linux_desktopredhat/enterprise_linux_serverredhat/enterprise_linux_server_ausredhat/enterprise_linux_server_eusredhat/enterprise_linux_workstation