CVE-2014-0145
published 2017-08-10CVE-2014-0145: Multiple buffer overflows in QEMU before 1.7.2 and 2.x before 2.0.0, allow local users to cause a denial of service (crash) or possibly execute arbitrary code…
PriorityP335high7.8CVSS 3.0
AVLACLPRLUINSUCHIHAH
EPSS
0.51%
40.4th percentile
Multiple buffer overflows in QEMU before 1.7.2 and 2.x before 2.0.0, allow local users to cause a denial of service (crash) or possibly execute arbitrary code via a large (1) L1 table in the qcow2_snapshot_load_tmp in the QCOW 2 block driver (block/qcow2-snapshot.c) or (2) uncompressed chunk, (3) chunk length, or (4) number of sectors in the DMG block driver (block/dmg.c).
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | qemu | < qemu 2.0.0+dfsg-1 (bookworm) | qemu 2.0.0+dfsg-1 (bookworm) |
| qemu | qemu | <= 1.7.1 | — |
| qemu | qemu | — | — |
| qemu | qemu | >= 0 < 2.0.0+dfsg-1 | 2.0.0+dfsg-1 |
| qemu | qemu | >= 0 < 2.0.0+dfsg-1 | 2.0.0+dfsg-1 |
| qemu | qemu | >= 0 < 2.0.0+dfsg-1 | 2.0.0+dfsg-1 |
| qemu | qemu | >= 0 < 2.0.0+dfsg-1 | 2.0.0+dfsg-1 |
| qemu | qemu | >= 0 < 2.0.0+dfsg-2ubuntu1.3 | 2.0.0+dfsg-2ubuntu1.3 |
CVSS provenance
nvdv3.07.8HIGHCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.04.6MEDIUMAV:L/AC:L/Au:N/C:P/I:P/A:P
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
vendor_ubuntu7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
QEMU vulnerabilities
vendor_ubuntu·2014-09-08·CVSS 7.5
CVE-2013-4148 [HIGH] QEMU vulnerabilities
Title: QEMU vulnerabilities
Summary: Several security issues were fixed in QEMU.
Michael S. Tsirkin, Anthony Liguori, and Michael Roth discovered multiple
issues with QEMU state loading after migration. An attacker able to modify
the state data could use these issues to cause a denial of service, or
possibly execute arbitrary code. (CVE-2013-4148, CVE-2013-4149,
CVE-2013-4150, CVE-2013-4151, CVE-2013-4526, CVE-2013-4527, CVE-2013-4529,
CVE-2013-4530, CVE-2013-4531, CVE-2013-4532, CVE-2013-4533, CVE-2013-4534,
CVE-2013-4535, CVE-2013-4536, CVE-2013-4537, CVE-2013-4538, CVE-2013-4539,
CVE-2013-4540, CVE-2013-4541, CVE-2013-4542, CVE-2013-6399, CVE-2014-0182,
CVE-2014-3461)
Kevin Wolf, Stefan Hajnoczi, Fam Zheng, Jeff Cody, Stefan Hajnoczi, and
others discovered multiple issues in the QEMU
Red Hat
Qemu: prevent possible buffer overflows
vendor_redhat·2014-03-26·CVSS 7.8
CVE-2014-0145 [HIGH] CWE-119 Qemu: prevent possible buffer overflows
Qemu: prevent possible buffer overflows
Multiple buffer overflows in QEMU before 1.7.2 and 2.x before 2.0.0, allow local users to cause a denial of service (crash) or possibly execute arbitrary code via a large (1) L1 table in the qcow2_snapshot_load_tmp in the QCOW 2 block driver (block/qcow2-snapshot.c) or (2) uncompressed chunk, (3) chunk length, or (4) number of sectors in the DMG block driver (block/dmg.c).
Package: kvm (Red Hat Enterprise Linux 5) - Will not fix
Package: qemu-kvm (Red Hat Enterprise Linux 7) - Not affected
Package: qemu-kvm-rhev (Red Hat Enterprise Linux OpenStack Platform 5 (Icehouse)) - Affected
Debian
CVE-2014-0145: qemu - Multiple buffer overflows in QEMU before 1.7.2 and 2.x before 2.0.0, allow local...
vendor_debian·2014·CVSS 7.8
CVE-2014-0145 [HIGH] CVE-2014-0145: qemu - Multiple buffer overflows in QEMU before 1.7.2 and 2.x before 2.0.0, allow local...
Multiple buffer overflows in QEMU before 1.7.2 and 2.x before 2.0.0, allow local users to cause a denial of service (crash) or possibly execute arbitrary code via a large (1) L1 table in the qcow2_snapshot_load_tmp in the QCOW 2 block driver (block/qcow2-snapshot.c) or (2) uncompressed chunk, (3) chunk length, or (4) number of sectors in the DMG block driver (block/dmg.c).
Scope: local
bookworm: resolved (fixed in 2.0.0+dfsg-1)
bullseye: resolved (fixed in 2.0.0+dfsg-1)
forky: resolved (fixed in 2.0.0+dfsg-1)
sid: resolved (fixed in 2.0.0+dfsg-1)
trixie: resolved (fixed in 2.0.0+dfsg-1)
GHSA
GHSA-cc9p-3fx3-m352: Multiple buffer overflows in QEMU before 1
ghsa_unreviewed·2022-05-17
CVE-2014-0145 [HIGH] CWE-119 GHSA-cc9p-3fx3-m352: Multiple buffer overflows in QEMU before 1
Multiple buffer overflows in QEMU before 1.7.2 and 2.x before 2.0.0, allow local users to cause a denial of service (crash) or possibly execute arbitrary code via a large (1) L1 table in the qcow2_snapshot_load_tmp in the QCOW 2 block driver (block/qcow2-snapshot.c) or (2) uncompressed chunk, (3) chunk length, or (4) number of sectors in the DMG block driver (block/dmg.c).
OSV
CVE-2014-0145: Multiple buffer overflows in QEMU before 1
osv·2017-08-10·CVSS 7.8
CVE-2014-0145 [HIGH] CVE-2014-0145: Multiple buffer overflows in QEMU before 1
Multiple buffer overflows in QEMU before 1.7.2 and 2.x before 2.0.0, allow local users to cause a denial of service (crash) or possibly execute arbitrary code via a large (1) L1 table in the qcow2_snapshot_load_tmp in the QCOW 2 block driver (block/qcow2-snapshot.c) or (2) uncompressed chunk, (3) chunk length, or (4) number of sectors in the DMG block driver (block/dmg.c).
OSV
qemu, qemu-kvm vulnerabilities
osv·2014-09-08·CVSS 7.5
CVE-2013-4148 [HIGH] qemu, qemu-kvm vulnerabilities
qemu, qemu-kvm vulnerabilities
Michael S. Tsirkin, Anthony Liguori, and Michael Roth discovered multiple
issues with QEMU state loading after migration. An attacker able to modify
the state data could use these issues to cause a denial of service, or
possibly execute arbitrary code. (CVE-2013-4148, CVE-2013-4149,
CVE-2013-4150, CVE-2013-4151, CVE-2013-4526, CVE-2013-4527, CVE-2013-4529,
CVE-2013-4530, CVE-2013-4531, CVE-2013-4532, CVE-2013-4533, CVE-2013-4534,
CVE-2013-4535, CVE-2013-4536, CVE-2013-4537, CVE-2013-4538, CVE-2013-4539,
CVE-2013-4540, CVE-2013-4541, CVE-2013-4542, CVE-2013-6399, CVE-2014-0182,
CVE-2014-3461)
Kevin Wolf, Stefan Hajnoczi, Fam Zheng, Jeff Cody, Stefan Hajnoczi, and
others discovered multiple issues in the QEMU block drivers. An attacker
able to modify disk ima
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2014-0145 Qemu: prevent possible buffer overflows [fedora-all]
bugzilla·2014-04-11·CVSS 7.8
CVE-2014-0145 [HIGH] CVE-2014-0145 Qemu: prevent possible buffer overflows [fedora-all]
CVE-2014-0145 Qemu: prevent possible buffer overflows [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
Please note: this issue affects multip
Bugzilla
CVE-2014-0145 Qemu: prevent possible buffer overflows
bugzilla·2014-03-20·CVSS 7.8
CVE-2014-0145 [HIGH] CVE-2014-0145 Qemu: prevent possible buffer overflows
CVE-2014-0145 Qemu: prevent possible buffer overflows
Qemu block drivers for DMG and QCOW version 2 format images are vulnerable to
possible buffer overflows caused by logic errors or non-sanitised inputs from
the image files. Such buffer overflows could lead to memory/image corruption
or crash in Qemu instances resulting in DoS.
An user able to alter the Qemu disk image files loaded by a guest could use
this flaw to crash the Qemu instance resulting in DoS or corrupt QEMU process
memory on the host, which could potentially result in arbitrary code execution
on the host with the privileges of the QEMU process.
Upstream fixes:
qcow2: Fix L1 allocation size in qcow2_snapshot_load_tmp
-> http://git.qemu.org/?p=qemu.git;a=commit;h=c05e4667be91b46ab42b5a11babf8e84d476cc6b
dmg: prevent chunk
http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=c05e4667be91b46ab42b5a11babf8e84d476cc6bhttp://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=f0dce23475b5af5da6b17b97c1765271307734b6http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=c165f7758009a4f793c1fc19ebb69cf55313450bhttp://rhn.redhat.com/errata/RHSA-2014-0420.htmlhttp://rhn.redhat.com/errata/RHSA-2014-0421.htmlhttp://www.debian.org/security/2014/dsa-3044http://www.openwall.com/lists/oss-security/2014/03/26/8https://bugzilla.redhat.com/show_bug.cgi?id=1078885https://lists.gnu.org/archive/html/qemu-devel/2014-03/msg04994.htmlhttp://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=c05e4667be91b46ab42b5a11babf8e84d476cc6bhttp://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=f0dce23475b5af5da6b17b97c1765271307734b6http://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=c165f7758009a4f793c1fc19ebb69cf55313450bhttp://rhn.redhat.com/errata/RHSA-2014-0420.htmlhttp://rhn.redhat.com/errata/RHSA-2014-0421.htmlhttp://www.debian.org/security/2014/dsa-3044http://www.openwall.com/lists/oss-security/2014/03/26/8https://bugzilla.redhat.com/show_bug.cgi?id=1078885https://lists.gnu.org/archive/html/qemu-devel/2014-03/msg04994.html
2017-08-10
Published