CVE-2014-7840 — Improper Input Validation in Qemu

CWE-20 — Improper Input ValidationCWE-122 — Heap-based Buffer Overflow10 documents8 sources
Severity
7.5HIGHNVD
EPSS
2.5%
top 14.76%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
QemuRedhat Enterprise Linux DesktopRedhat Enterprise Linux EUS+4 more
Timeline
PublishedDec 12
Latest updateMay 13

Description

The host_from_stream_offset function in arch_init.c in QEMU, when loading RAM during migration, allows remote attackers to execute arbitrary code via a crafted (1) offset or (2) length value in savevm data.

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages7 packages

▶Debianqemu/qemu< 2.1+dfsg-8+3
▶Ubuntuqemu/qemu< 2.0.0+dfsg-2ubuntu1.9
▶NVDqemu/qemu2.1.3

Also affects: Enterprise Linux 7.3, 7.4, 7.5, 7.6, 7.7

🔴Vulnerability Details

4
GHSA
GHSA-m2wj-gq82-h93m: The host_from_stream_offset function in arch_init↗2022-05-13
▶
CVEList
CVE-2014-7840: The host_from_stream_offset function in arch_init↗2014-12-12
▶
OSV
CVE-2014-7840: The host_from_stream_offset function in arch_init↗2014-12-12
▶
OSV
qemu, qemu-kvm vulnerabilities↗2014-12-11
▶

📋Vendor Advisories

3
Ubuntu
QEMU vulnerabilities↗2014-12-11
▶
Red Hat
qemu: insufficient parameter validation during ram load↗2014-11-12
▶
Debian
CVE-2014-7840: qemu - The host_from_stream_offset function in arch_init.c in QEMU, when loading RAM du...↗2014
▶

💬Community

2
Bugzilla
CVE-2014-7840 qemu: insufficient parameter validation during ram load [fedora-all]↗2014-11-12
▶
Bugzilla
CVE-2014-7840 qemu: insufficient parameter validation during ram load↗2014-11-12
▶
CVE-2014-7840 — Improper Input Validation in Qemu | cvebase