Vulnerability Description
A flaw was found in qemu Media Transfer Protocol (MTP). The code opening files in usb_mtp_get_object and usb_mtp_get_partial_object and directories in usb_mtp_object_readdir doesn't consider that the underlying filesystem may have changed since the time lstat(2) was called in usb_mtp_object_alloc, a classical TOCTTOU problem. An attacker with write access to the host filesystem shared with a guest can use this property to navigate the host filesystem in the context of the QEMU process and read any file the QEMU process has access to. Access to the filesystem may be local or via a network share protocol such as CIFS.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Qemu | Qemu | <= 3.1.0 |
| Debian | Debian Linux | 8.0 |
| Fedoraproject | Fedora | 29 |
| Canonical | Ubuntu Linux | 14.04 |
| Opensuse | Leap | 42.3 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00042.htmlMailing ListThird Party Advisory
- http://www.securityfocus.com/bid/106212Third Party AdvisoryVDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16872Issue TrackingPatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/02/msg00041.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproThird Party Advisory
- https://seclists.org/bugtraq/2019/May/76Mailing ListThird Party Advisory
- https://usn.ubuntu.com/3923-1/Third Party Advisory
- https://www.debian.org/security/2019/dsa-4454Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00042.htmlMailing ListThird Party Advisory
- http://www.securityfocus.com/bid/106212Third Party AdvisoryVDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16872Issue TrackingPatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/02/msg00041.htmlMailing ListThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproThird Party Advisory
FAQ
What is CVE-2018-16872?
CVE-2018-16872 is a vulnerability with a CVSS score of 5.3 (MEDIUM). A flaw was found in qemu Media Transfer Protocol (MTP). The code opening files in usb_mtp_get_object and usb_mtp_get_partial_object and directories in usb_mtp_object_readdir doesn't consider that the ...
How severe is CVE-2018-16872?
CVE-2018-16872 has been rated MEDIUM with a CVSS base score of 5.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2018-16872?
Check the references section above for vendor advisories and patch information. Affected products include: Qemu Qemu, Debian Debian Linux, Fedoraproject Fedora, Canonical Ubuntu Linux, Opensuse Leap.