News
Vigil@nce - QEMU: integer overflow of qcow1 L2
May 2014 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
An attacker can generate an integer overflow in QEMU via qcow1, in
order to trigger a denial of service, and possibly to execute code.
– Impacted products: Unix (platform)
– Severity: 2/4
– Creation date: 13/05/2014
DESCRIPTION OF THE VULNERABILITY
The QEMU product can load disk images in several formats: qcow,
bochs, etc.
However, the qcow_open() function does not check if the size of
the L2 table is too large, then an allocated memory area is too
short.
An attacker can therefore generate an integer overflow in QEMU via
qcow1, in order to trigger a denial of service, and possibly to
execute code.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
http://vigilance.fr/vulnerability/QEMU-integer-overflow-of-qcow1-L2-14730
