Vulnerability CVE-2017-9503: Information

Description

QEMU (aka Quick Emulator), when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows local guest OS privileged users to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors involving megasas command processing.

Severity: MEDIUM (5.5) Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

URL: https://nvd.nist.gov/vuln/detail/CVE-2017-9503
Published: June 17, 2017
Modified: Nov. 10, 2020
Error type identifier: CWE-476

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
pve-qemusisyphus2.9.0-alt38.1.5-alt1ALT-PU-2017-1993-1186770Fixed
pve-qemup102.9.0-alt37.2.0-alt4ALT-PU-2017-1993-1186770Fixed
pve-qemup92.9.0-alt35.1.0-alt6ALT-PU-2017-1993-1186770Fixed
pve-qemup82.9.0-alt0.M80P.32.12.1-alt1ALT-PU-2017-1994-1186771Fixed
pve-qemuc10f12.9.0-alt37.2.0-alt3ALT-PU-2017-1993-1186770Fixed
pve-qemuc9f22.9.0-alt35.1.0-alt6ALT-PU-2017-1993-1186770Fixed
qemusisyphus2.10.0-alt18.2.2-alt3ALT-PU-2017-2175-1187863Fixed
qemusisyphus_e2k7.2.0-alt3.E2K.37.2.0-alt3.E2K.4ALT-PU-2024-1953-1-Fixed
qemup102.10.0-alt18.2.2-alt0.p10.1ALT-PU-2017-2175-1187863Fixed
qemup10_e2k7.2.0-alt3.E2K.07.2.0-alt3.E2K.3ALT-PU-2023-6766-1-Fixed
qemup92.10.0-alt15.2.0-alt6ALT-PU-2017-2175-1187863Fixed
qemup82.11.0-alt0.M80P.12.11.0-alt0.M80P.4ALT-PU-2018-1018-1197530Fixed
qemuc10f12.10.0-alt18.0.4-alt1.p10ALT-PU-2017-2175-1187863Fixed
qemuc9f22.10.0-alt15.2.0-alt6.c9.1ALT-PU-2017-2175-1187863Fixed
qemuc72.5.1.1-alt0.M70C.42.5.1.1-alt0.M70C.5ALT-PU-2017-2202-1188182Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
[qemu-devel] 20170606 [PATCH 7/7] megasas: always store SCSIRequest* into Megasas
  • Issue Tracking
  • Patch
  • Third Party Advisory
[qemu-devel] 20170606 [PATCH 4/7] megasas: do not read DCMD opcode more than once
  • Issue Tracking
  • Patch
  • Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1459477
  • Issue Tracking
  • Patch
  • Third Party Advisory
[oss-security] 20170608 CVE-2017-9503 Qemu: scsi: null pointer dereference while processing megasas command
  • Mailing List
  • Patch
  • Third Party Advisory
99010
  • Third Party Advisory
  • VDB Entry
[debian-lts-announce] 20180906 [SECURITY] [DLA 1497-1] qemu security update
  • Third Party Advisory
[debian-lts-announce] 20200726 [SECURITY] [DLA 2288-1] qemu security update
  • Third Party Advisory

    1. Configuration 1

      cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*
      End including
      2.9.1

      Configuration 2

      cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
      cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
Version: v24.4.2
Back to top