CVE-2014-9718

Severity

49%

Complexity

39%

Confidentiality

115%

The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality in QEMU 1.0 through 2.1.3 have multiple interpretations of a function's return value, which allows guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions.

The (1) BMDMA and (2) AHCI HBA interfaces in the IDE functionality in QEMU 1.0 through 2.1.3 have multiple interpretations of a function's return value, which allows guest OS users to cause a host OS denial of service (memory consumption or infinite loop, and system crash) via a PRDT with zero complete sectors, related to the bmdma_prepare_buf and ahci_dma_prepare_buf functions.

CVSS 2.0 Base Score 4.9. CVSS Attack Vector: local. CVSS Attack Complexity: low. CVSS Vector: (AV:L/AC:L/Au:N/C:N/I:N/A:C).

Overview

First reported 9 years ago

2015-04-21 16:59:00

Last updated 8 years ago

2016-06-23 18:30:00

Affected Software

Debian Linux 8.0 (Jessie)

8.0

QEMU 1.0

1.0

QEMU 1.0 release candidate 1

1.0

QEMU 1.0 release candidate 2

1.0

QEMU 1.0 release candidate 3

1.0

QEMU 1.0 release candidate 4

1.0

QEMU 1.0.1

1.0.1

QEMU 1.1

1.1

QEMU 1.1 release candidate 1

1.1

QEMU 1.1 release candidate 2

1.1

QEMU 1.1 release candidate 3

1.1

QEMU 1.1 release candidate 4

1.1

QEMU 1.4.1

1.4.1

QEMU 1.4.2

1.4.2

QEMU 1.5.0

1.5.0

QEMU 1.5.0 release candidate 1

1.5.0

QEMU 1.5.0 release candidate 2

1.5.0

QEMU 1.5.0 release candidate 3

1.5.0

QEMU 1.5.1

1.5.1

QEMU 1.5.2

1.5.2

QEMU 1.5.3

1.5.3

QEMU 1.6.0

1.6.0

QEMU 1.6.0 release candidate 1

1.6.0

QEMU 1.6.0 release candidate 2

1.6.0

QEMU 1.6.0 release candidate 3

1.6.0

QEMU 1.6.1

1.6.1

QEMU 1.6.2

1.6.2

QEMU 1.7.1

1.7.1

QEMU 2.0.0

2.0.0

QEMU 2.0.0 release candidate 0

2.0.0

QEMU 2.0.0 release candidate 1

2.0.0

QEMU 2.0.0 release candidate 2

2.0.0

QEMU 2.0.0 release candidate 3

2.0.0

QEMU QEMU 2.0.2

2.0.2

QEMU QEMU 2.1.0

2.1.0

QEMU QEMU 2.1.0 release candidate 0

2.1.0

QEMU QEMU 2.1.0 release candidate 1

2.1.0

QEMU QEMU 2.1.0 release candidate 2

2.1.0

QEMU QEMU 2.1.0 release candidate 3

2.1.0

QEMU QEMU 2.1.0 release candidate 5

2.1.0

QEMU QEMU 2.1.1

2.1.1

QEMU QEMU 2.1.2

2.1.2

QEMU 2.1.3

2.1.3

References

http://git.qemu.org/?p=qemu.git;a=commit;h=3251bdcf1c67427d964517053c3d185b46e618e8

[oss-security] 20150420 Re: CVE request Qemu: malicious PRDT flow from guest to host

DSA-3259

73316

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.