CVE-2017-14167

Public on 2017-12-20
Modified on 2017-12-21
Description
Quick Emulator (QEMU), compiled with the PC System Emulator with multiboot feature support, is vulnerable to an OOB r/w memory access issue. The issue could occur due to an integer overflow while loading a kernel image during a guest boot. A user or process could use this flaw to potentially achieve arbitrary code execution on a host.
Severity
Medium
CVSS v3 Base Score
4.9
See breakdown

Affected Packages

Platform Package Release Date Advisory
Amazon Linux 1 qemu-kvm 2017-12-20 18:55 ALAS-2017-934

CVSS Scores

Score Type Score Vector
Amazon Linux CVSSv2 3.7 AV:L/AC:H/Au:N/C:P/I:P/A:P
Amazon Linux CVSSv3 4.9 CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
NVD CVSSv2 7.2 AV:L/AC:L/Au:N/C:C/I:C/A:C
NVD CVSSv3 8.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H