CVE-2017-9503 — NULL Pointer Dereference in Qemu

CWE-476 — NULL Pointer Dereference11 documents7 sources
Severity
5.5MEDIUMNVD
OSV7.8
EPSS
0.1%
top 78.62%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
QemuDebian QemuDebian Linux
Timeline
PublishedJun 16
Latest updateMay 13

Description

QEMU (aka Quick Emulator), when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows local guest OS privileged users to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors involving megasas command processing.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages4 packages

▶debiandebian/qemu< qemu 1:2.10.0-1 (bookworm)
▶Debianqemu/qemu< 1:2.10.0-1+3
▶Ubuntuqemu/qemu< 2.0.0+dfsg-2ubuntu1.36+3
▶NVDqemu/qemu2.9.1

Also affects: Debian Linux 8.0, 9.0

Patches

Patch: www.openwall.com ↗Patch: bugzilla.redhat.com ↗Patch: lists.gnu.org ↗

🔴Vulnerability Details

4
GHSA
GHSA-f8cp-6xg3-m3rg: QEMU (aka Quick Emulator), when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows local guest OS privileged users to cause a↗2022-05-13
▶
OSV
qemu regression↗2017-09-20
▶
OSV
qemu vulnerabilities↗2017-09-13
▶
OSV
CVE-2017-9503: QEMU (aka Quick Emulator), when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows local guest OS privileged users to cause a↗2017-06-16
▶

📋Vendor Advisories

4
Ubuntu
QEMU regression↗2017-09-20
▶
Ubuntu
QEMU vulnerabilities↗2017-09-13
▶
Red Hat
Qemu: scsi: megasas: null pointer dereference while processing megasas command↗2017-05-10
▶
Debian
CVE-2017-9503: qemu - QEMU (aka Quick Emulator), when built with MegaRAID SAS 8708EM2 Host Bus Adapter...↗2017
▶

💬Community

2
Bugzilla
CVE-2017-9503 Qemu: scsi: megasas: null pointer dereference while processing megasas command↗2017-06-07
▶
Bugzilla
CVE-2017-9503 Qemu: scsi: megasas: null pointer dereference while processing megasas command [fedora-all]↗2017-06-07
▶