CVE-2018-18954 — Out-of-bounds Read in Qemu

CWE-125 — Out-of-bounds ReadCWE-787 — Out-of-bounds WriteCWE-121 — Stack-based Buffer Overflow9 documents7 sources
Severity
5.5MEDIUMNVD
OSV6.5
EPSS
0.1%
top 69.20%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
QemuDebian QemuCanonical Ubuntu Linux+1 more
Timeline
PublishedNov 15
Latest updateMay 14

Description

The pnv_lpc_do_eccb function in hw/ppc/pnv_lpc.c in Qemu before 3.1 allows out-of-bounds write or read access to PowerNV memory.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.8 | Impact: 3.6

Affected Packages5 packages

▶NVDqemu/qemu< 3.1
▶debiandebian/qemu< qemu 1:3.1+dfsg-1 (bookworm)
▶Debianqemu/qemu< 1:3.1+dfsg-1+3
▶Ubuntuqemu/qemu< 2.0.0+dfsg-2ubuntu1.44+2
▶NVDopensuse/leap42.3

Also affects: Ubuntu Linux 18.04, 18.10

Patches

Patch: www.openwall.com ↗Patch: lists.gnu.org ↗Patch: www.openwall.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-x3wx-mf88-5pm7: The pnv_lpc_do_eccb function in hw/ppc/pnv_lpc↗2022-05-14
▶
OSV
qemu vulnerabilities↗2018-11-26
▶
OSV
CVE-2018-18954: The pnv_lpc_do_eccb function in hw/ppc/pnv_lpc↗2018-11-15
▶

📋Vendor Advisories

3
Ubuntu
QEMU vulnerabilities↗2018-11-26
▶
Red Hat
QEMU: ppc64: Out-of-bounds r/w stack access in pnv_lpc_do_eccb↗2018-10-22
▶
Debian
CVE-2018-18954: qemu - The pnv_lpc_do_eccb function in hw/ppc/pnv_lpc.c in Qemu before 3.1 allows out-o...↗2018
▶

💬Community

2
Bugzilla
CVE-2018-18954 qemu: ppc64: Out-of-bounds r/w stack access in pnv_lpc_do_eccb [fedora-all]↗2018-11-06
▶
Bugzilla
CVE-2018-18954 QEMU: ppc64: Out-of-bounds r/w stack access in pnv_lpc_do_eccb↗2017-12-14
▶