CVE-2017-5898

CWE-190 — Integer Overflow9 documents8 sources
Severity
5.5MEDIUM
EPSS
0.1%
top 73.83%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Qemu QemuSuse Linux Enterprise DesktopSuse Linux Enterprise Server+2 more
Timeline
PublishedMar 15
Latest updateMay 13

Description

Integer overflow in the emulated_apdu_from_guest function in usb/dev-smartcard-reader.c in Quick Emulator (Qemu), when built with the CCID Card device emulator support, allows local users to cause a denial of service (application crash) via a large Application Protocol Data Units (APDU) unit.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages5 packages

▶Debianqemu< 1:2.8+dfsg-3+3
▶NVDqemu/qemu2.8.1.1

Also affects: Linux Enterprise 12

Patches

Patch: www.openwall.com ↗Patch: bugzilla.redhat.com ↗Patch: security.gentoo.org ↗

🔴Vulnerability Details

3
GHSA
GHSA-vfvm-h748-r758: Integer overflow in the emulated_apdu_from_guest function in usb/dev-smartcard-reader↗2022-05-13
▶
CVEList
CVE-2017-5898: Integer overflow in the emulated_apdu_from_guest function in usb/dev-smartcard-reader↗2017-03-15
▶
OSV
CVE-2017-5898: Integer overflow in the emulated_apdu_from_guest function in usb/dev-smartcard-reader↗2017-03-15
▶

📋Vendor Advisories

3
Ubuntu
QEMU vulnerabilities↗2017-04-20
▶
Red Hat
Qemu: usb: integer overflow in emulated_apdu_from_guest↗2017-02-03
▶
Debian
CVE-2017-5898: qemu - Integer overflow in the emulated_apdu_from_guest function in usb/dev-smartcard-r...↗2017
▶

💬Community

2
Bugzilla
CVE-2017-5898 Qemu: usb: integer overflow in emulated_apdu_from_guest↗2017-02-06
▶
Bugzilla
CVE-2017-5898 Qemu: usb: integer overflow in emulated_apdu_from_guest [fedora-all]↗2017-02-06
▶
CVE-2017-5898 (MEDIUM CVSS 5.5) | Integer overflow in the emulated_ap | cvebase.io