CVE-2017-14167 — Integer Overflow or Wraparound in Qemu

CWE-190 — Integer Overflow or Wraparound12 documents8 sources
Severity
8.8HIGHNVD
OSV4.4
EPSS
0.1%
top 77.48%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
QemuDebian QemuDebian Linux+3 more
Timeline
PublishedSep 8
Latest updateMay 13

Description

Integer overflow in the load_multiboot function in hw/i386/multiboot.c in QEMU (aka Quick Emulator) allows local guest OS users to execute arbitrary code on the host via crafted multiboot header address values, which trigger an out-of-bounds write.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HExploitability: 2.0 | Impact: 6.0

Affected Packages7 packages

▶debiandebian/qemu< qemu 1:2.10.0-1 (bookworm)
▶Debianqemu/qemu< 1:2.10.0-1+3
▶Ubuntuqemu/qemu< 2.0.0+dfsg-2ubuntu1.39+3
▶NVDqemu/qemu2.10.2

Also affects: Debian Linux 8.0, 9.0

Patches

Patch: www.openwall.com ↗Patch: lists.nongnu.org ↗Patch: www.openwall.com ↗

🔴Vulnerability Details

4
GHSA
GHSA-g34v-j3w9-h65r: Integer overflow in the load_multiboot function in hw/i386/multiboot↗2022-05-13
▶
OSV
qemu regression↗2018-03-05
▶
OSV
qemu vulnerabilities↗2018-02-20
▶
OSV
CVE-2017-14167: Integer overflow in the load_multiboot function in hw/i386/multiboot↗2017-09-08
▶

📋Vendor Advisories

5
Ubuntu
QEMU regression↗2018-03-05
▶
Ubuntu
QEMU vulnerabilities↗2018-02-20
▶
Microsoft
Integer overflow in the load_multiboot function in hw/i386/multiboot.c in QEMU (aka Quick Emulator) allows local guest OS users to execute arbitrary code on the host via crafted multiboot header addre↗2017-09-12
▶
Red Hat
Qemu: i386: multiboot OOB access while loading kernel image↗2017-09-05
▶
Debian
CVE-2017-14167: qemu - Integer overflow in the load_multiboot function in hw/i386/multiboot.c in QEMU (...↗2017
▶

💬Community

2
Bugzilla
CVE-2017-14167 Qemu: i386: multiboot OOB access while loading kernel image↗2017-09-07
▶
Bugzilla
CVE-2017-14167 Qemu: i386: multiboot OOB access while loading kernel image [fedora-all]↗2017-09-07
▶