Home

CVE-2017-5931

Description

Integer overflow in hw/virtio/virtio-crypto.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (QEMU process crash) or possibly execute arbitrary code on the host via a crafted virtio-crypto request, which triggers a heap-based buffer overflow.

Risk Information

Base Score
8.8
MODERATE
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
EPSS Score
Exploitation Probability
0.221

Associated Vulnerability

VulnerabilityOS Platform
Multiple vulnerabilities affected in QEMU 2.8.1.1Windows
Qemu update (ELSA-2019-4713) qemu-3.1.0-5.el7.x86_64.rpmLinux
Qemu-block-gluster update (ELSA-2019-4713) qemu-block-gluster-3.1.0-5.el7.x86_64.rpmLinux
Qemu-block-iscsi update (ELSA-2019-4713) qemu-block-iscsi-3.1.0-5.el7.x86_64.rpmLinux
Qemu-block-rbd update (ELSA-2019-4713) qemu-block-rbd-3.1.0-5.el7.x86_64.rpmLinux
Qemu-common update (ELSA-2019-4713) qemu-common-3.1.0-5.el7.x86_64.rpmLinux
Qemu-img update (ELSA-2019-4713) qemu-img-3.1.0-5.el7.x86_64.rpmLinux
Qemu-kvm update (ELSA-2019-4713) qemu-kvm-3.1.0-5.el7.x86_64.rpmLinux
Qemu-kvm-core update (ELSA-2019-4713) qemu-kvm-core-3.1.0-5.el7.x86_64.rpmLinux
Qemu-system-x86 update (ELSA-2019-4713) qemu-system-x86-3.1.0-5.el7.x86_64.rpmLinux
Qemu-system-x86-core update (ELSA-2019-4713) qemu-system-x86-core-3.1.0-5.el7.x86_64.rpmLinux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234