CVE-2017-2620

Description

Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue. The issue could occur while copying VGA data in cirrus_bitblt_cputovideo. A privileged user inside guest could use this flaw to crash the QEMU process OR potentially execute arbitrary code on host with privileges of the QEMU process.

Risk Information

Base Score

9.9

MODERATE

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS Score

Exploitation Probability

2.41

Associated Vulnerability

Vulnerability	OS Platform
Vulnerability CVE-2016-9907,CVE-2016-9911,CVE-2017-2620 are affected in QEMU 2.7.1	Windows
Multiple Vulnerabilities are affected in Citrix XenCenter 6.0.2	Windows
Multiple Vulnerabilities are affected in Citrix XenCenter 6.2.0	Windows
Multiple Vulnerabilities are affected in Citrix XenCenter 6.5	Windows
Multiple Vulnerabilities are affected in Citrix XenCenter 7.0	Windows
Multiple Vulnerabilities are affected in Citrix XenCenter 7.1	Windows
(RHSA-2017:0454) Important: kvm security update kmod-kvm-83-277.el5_11.x86_64.rpm	Linux
(RHSA-2017:0454) Important: kvm security update kmod-kvm-debug-83-277.el5_11.x86_64.rpm	Linux
(RHSA-2017:0454) Important: kvm security update kvm-83-277.el5_11.x86_64.rpm	Linux
(RHSA-2017:0454) Important: kvm security update kvm-qemu-img-83-277.el5_11.x86_64.rpm	Linux
(RHSA-2017:0454) Important: kvm security update kvm-tools-83-277.el5_11.x86_64.rpm	Linux
Out-of-bounds Write Vulnerability (CVE-2017-2620)	NCM

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234