Vulnerability Description
Memory leak in QEMU (aka Quick Emulator), when built with USB EHCI Emulation support, allows local guest OS privileged users to cause a denial of service (memory consumption) by repeatedly hot-unplugging the device.
CVSS Score
5.5
MEDIUM
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Qemu | Qemu | <= 2.8.1.1 |
Related Weaknesses (CWE)
References
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=d710e1e7bd3d5bfc26b631f02ae87901e
- http://www.debian.org/security/2017/dsa-3920Third Party Advisory
- http://www.openwall.com/lists/oss-security/2017/06/06/3Mailing ListPatchThird Party Advisory
- http://www.securityfocus.com/bid/98905Third Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2017:2392Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:2408Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1459132Issue TrackingPatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.htmlThird Party Advisory
- http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=d710e1e7bd3d5bfc26b631f02ae87901e
- http://www.debian.org/security/2017/dsa-3920Third Party Advisory
- http://www.openwall.com/lists/oss-security/2017/06/06/3Mailing ListPatchThird Party Advisory
- http://www.securityfocus.com/bid/98905Third Party AdvisoryVDB Entry
- https://access.redhat.com/errata/RHSA-2017:2392Third Party Advisory
- https://access.redhat.com/errata/RHSA-2017:2408Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1459132Issue TrackingPatchThird Party Advisory
FAQ
What is CVE-2017-9374?
CVE-2017-9374 is a vulnerability with a CVSS score of 5.5 (MEDIUM). Memory leak in QEMU (aka Quick Emulator), when built with USB EHCI Emulation support, allows local guest OS privileged users to cause a denial of service (memory consumption) by repeatedly hot-unplugg...
How severe is CVE-2017-9374?
CVE-2017-9374 has been rated MEDIUM with a CVSS base score of 5.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2017-9374?
Check the references section above for vendor advisories and patch information. Affected products include: Qemu Qemu.