high8.3Public exploit code
CVE-2017-15118
A stack-based buffer overflow vulnerability was found in NBD server implementation in qemu before 2.11 allowing a client to request an export name of size up t…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- QEMU - NBD Server Long Export Name Stack Buffer Overflow2017-11-29 · dos · linux · Verified
Impact
A stack-based buffer overflow vulnerability was found in NBD server implementation in qemu before 2.11 allowing a client to request an export name of size up to 4096 bytes, which in fact should be limited to 256 bytes, causing an out-of-bounds stack write in the qemu process. If NBD server requires TLS, the attacker cannot trigger the buffer overflow without first successfully negotiating TLS.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Qemu | Qemu | before 2.11 |
| Canonical | Ubuntu Linux | Versions 14.04, 16.04, 17.10 |
| Redhat | Enterprise Linux | Version 7.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.openwall.com/lists/oss-security/2017/11/28/8
- http://www.securityfocus.com/bid/101975
- https://access.redhat.com/errata/RHSA-2018:1104
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15118
- https://lists.gnu.org/archive/html/qemu-devel/2017-11/msg05045.html
- https://usn.ubuntu.com/3575-1/
- https://www.exploit-db.com/exploits/43194/
- http://www.openwall.com/lists/oss-security/2017/11/28/8
- http://www.securityfocus.com/bid/101975
- https://access.redhat.com/errata/RHSA-2018:1104
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15118
- https://lists.gnu.org/archive/html/qemu-devel/2017-11/msg05045.html
- https://usn.ubuntu.com/3575-1/
- https://www.exploit-db.com/exploits/43194/