CVE-2014-9718
published 2015-04-21CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality in QEMU 1.0 through 2.1.3 have multiple interpretations of a function's return value, which…
PriorityP416medium4.9CVSS 2.0
AVLACLAuNCNINAC
EPSS
0.41%
33.3th percentile
The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality in QEMU 1.0 through 2.1.3 have multiple interpretations of a function's return value, which allows guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions.
Affected
26 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | qemu | < qemu 1:2.3+dfsg-1 (bookworm) | qemu 1:2.3+dfsg-1 (bookworm) |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | — | — |
| qemu | qemu | >= 0 < 1:2.3+dfsg-1 | 1:2.3+dfsg-1 |
| qemu | qemu | >= 0 < 1:2.3+dfsg-1 | 1:2.3+dfsg-1 |
| qemu | qemu | >= 0 < 1:2.3+dfsg-1 | 1:2.3+dfsg-1 |
| qemu | qemu | >= 0 < 1:2.3+dfsg-1 | 1:2.3+dfsg-1 |
CVSS provenance
nvdv2.04.9MEDIUMAV:L/AC:L/Au:N/C:N/I:N/A:C
osv4.9MEDIUM
vendor_debian4.9LOW
vendor_redhat4.9MEDIUM
vendor_ubuntu4.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-wc8f-g43g-pgxv: The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality in QEMU 1
ghsa_unreviewed·2022-05-17
CVE-2014-9718 [MEDIUM] GHSA-wc8f-g43g-pgxv: The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality in QEMU 1
The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality in QEMU 1.0 through 2.1.3 have multiple interpretations of a function's return value, which allows guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions.
OSV
qemu, qemu-kvm vulnerabilities
osv·2015-08-27·CVSS 4.9
CVE-2014-9718 [MEDIUM] qemu, qemu-kvm vulnerabilities
qemu, qemu-kvm vulnerabilities
It was discovered that QEMU incorrectly handled a PRDT with zero complete
sectors in the IDE functionality. A malicious guest could possibly use
this issue to cause a denial of service. This issue only affected Ubuntu
12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-9718)
Donghai Zhu discovered that QEMU incorrectly handled the RTL8139 driver.
A malicious guest could possibly use this issue to read sensitive
information from arbitrary host memory. (CVE-2015-5165)
Donghai Zhu discovered that QEMU incorrectly handled unplugging emulated
block devices. A malicious guest could use this issue to cause a denial of
service, or possibly execute arbitrary code on the host as the user running
the QEMU process. In the default installation, when QEMU is used with
libvirt, at
OSV
CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality in QEMU 1
osv·2015-04-21·CVSS 4.9
CVE-2014-9718 [MEDIUM] CVE-2014-9718: The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality in QEMU 1
The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality in QEMU 1.0 through 2.1.3 have multiple interpretations of a function's return value, which allows guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions.
Ubuntu
QEMU vulnerabilities
vendor_ubuntu·2015-08-27·CVSS 4.9
CVE-2014-9718 [MEDIUM] QEMU vulnerabilities
Title: QEMU vulnerabilities
Summary: Several security issues were fixed in QEMU.
It was discovered that QEMU incorrectly handled a PRDT with zero complete
sectors in the IDE functionality. A malicious guest could possibly use
this issue to cause a denial of service. This issue only affected Ubuntu
12.04 LTS and Ubuntu 14.04 LTS. (CVE-2014-9718)
Donghai Zhu discovered that QEMU incorrectly handled the RTL8139 driver.
A malicious guest could possibly use this issue to read sensitive
information from arbitrary host memory. (CVE-2015-5165)
Donghai Zhu discovered that QEMU incorrectly handled unplugging emulated
block devices. A malicious guest could use this issue to cause a denial of
service, or possibly execute arbitrary code on the host as the user running
the QEMU process. In the defau
Red Hat
Qemu: PRDT overflow from guest to host
vendor_redhat·2014-10-31·CVSS 4.9
CVE-2014-9718 [MEDIUM] CWE-835 Qemu: PRDT overflow from guest to host
Qemu: PRDT overflow from guest to host
The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality in QEMU 1.0 through 2.1.3 have multiple interpretations of a function's return value, which allows guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions.
A denial of service flaw was found in the way QEMU handled malformed Physical Region Descriptor Table (PRDT) data sent to the host's IDE and/or AHCI controller emulation. A privileged guest user could use this flaw to crash the system.
Statement: This issue did not affect the versions of the kvm package as shipped with Red Hat Enterprise Linux 5 and the versions of the qemu
Debian
CVE-2014-9718: qemu - The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality in QEMU 1.0 t...
vendor_debian·2014·CVSS 4.9
CVE-2014-9718 [MEDIUM] CVE-2014-9718: qemu - The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality in QEMU 1.0 t...
The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality in QEMU 1.0 through 2.1.3 have multiple interpretations of a function's return value, which allows guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions.
Scope: local
bookworm: resolved (fixed in 1:2.3+dfsg-1)
bullseye: resolved (fixed in 1:2.3+dfsg-1)
forky: resolved (fixed in 1:2.3+dfsg-1)
sid: resolved (fixed in 1:2.3+dfsg-1)
trixie: resolved (fixed in 1:2.3+dfsg-1)
No detection rules found.
No public exploits indexed.
http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=3251bdcf1c67427d964517053c3d185b46e618e8http://openwall.com/lists/oss-security/2015/04/20/7http://www.debian.org/security/2015/dsa-3259http://www.securityfocus.com/bid/73316http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=3251bdcf1c67427d964517053c3d185b46e618e8http://openwall.com/lists/oss-security/2015/04/20/7http://www.debian.org/security/2015/dsa-3259http://www.securityfocus.com/bid/73316
2015-04-21
Published