CVE-2014-5388 — Off-by-one Error in Qemu

CWE-193 — Off-by-one ErrorCWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer9 documents7 sources
Severity
4.6MEDIUMNVD
OSV2.1
EPSS
0.1%
top 70.54%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
QemuDebian QemuCanonical Ubuntu Linux
Timeline
PublishedNov 15
Latest updateMay 13

Description

Off-by-one error in the pci_read function in the ACPI PCI hotplug interface (hw/acpi/pcihp.c) in QEMU allows local guest users to obtain sensitive information and have other unspecified impact related to a crafted PCI device that triggers memory corruption.

CVSS vector

AV:L/AC:L/C:P/I:P/A:PExploitability: 3.9 | Impact: 6.4

Affected Packages4 packages

▶debiandebian/qemu< qemu 2.1+dfsg-5 (bookworm)
▶Debianqemu/qemu< 2.1+dfsg-5+3
▶Ubuntuqemu/qemu< 2.0.0+dfsg-2ubuntu1.7
▶NVDqemu/qemu2.1.3

Also affects: Ubuntu Linux 10.04, 12.04, 14.04, 14.10

Patches

Patch: seclists.org ↗Patch: lists.gnu.org ↗Patch: seclists.org ↗

🔴Vulnerability Details

3
GHSA
GHSA-hxhj-7442-hjrx: Off-by-one error in the pci_read function in the ACPI PCI hotplug interface (hw/acpi/pcihp↗2022-05-13
▶
OSV
CVE-2014-5388: Off-by-one error in the pci_read function in the ACPI PCI hotplug interface (hw/acpi/pcihp↗2014-11-15
▶
OSV
qemu, qemu-kvm vulnerabilities↗2014-11-13
▶

📋Vendor Advisories

3
Ubuntu
QEMU vulnerabilities↗2014-11-13
▶
Red Hat
Qemu: out of bounds memory access↗2014-08-19
▶
Debian
CVE-2014-5388: qemu - Off-by-one error in the pci_read function in the ACPI PCI hotplug interface (hw/...↗2014
▶

💬Community

2
Bugzilla
CVE-2014-5388 Qemu: out of bounds memory access↗2014-08-22
▶
Bugzilla
CVE-2014-5388: Qemu: out of bounds memory access [fedora-all]↗2014-08-22
▶