Memory Leak Vulnerability in QEMU Package Leading to Denial of Service
Summary
ALPINE-CVE-2017-5552: Memory leak in the virgl_resource_attach_backing function in hw/display/virtio-gpu-3d.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (host memory consumption) via a large number o... Affects qemu versions < 2.8.1-r1. Fixed in 2.8.1-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
QEMU, also known as Quick Emulator, is an open-source machine emulator and virtualizer that enables users to run multiple operating systems on a single host. It is widely used for virtualization and cloud computing. The package is known for its flexibility and support for various architectures. However, it has a vulnerability that can lead to significant memory consumption, affecting the host system's performance.
Vulnerability Detail
The vulnerability identified as CVE-2017-5552 is a memory leak in the virgl_resource_attach_backing function located in hw/display/virtio-gpu-3d.c. This flaw allows local guest OS users to execute a large number of VIRTIO_GPU_CMD_RESOURCE_ATTACH_BACKING commands, which can result in a denial of service due to excessive host memory consumption. The vulnerability affects multiple versions of the QEMU package across different Alpine Linux releases.
How To Fix
Minimum fixed version
2.8.1-r1
This is the first release that contains the fix.
sudo apk add --upgrade qemuTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the number of VIRTIO_GPU_CMD_RESOURCE_ATTACH_BACKING commands issued by guest OS users to mitigate the impact of this vulnerability until a patch is applied.
Conclusion
In summary, CVE-2017-5552 is a memory leak vulnerability in the QEMU package that can lead to denial of service due to excessive memory consumption. It is crucial to update to the patched versions to mitigate this risk and ensure system stability.
See every vulnerability recorded for qemu →
FAQ
CVE-2017-5552 is a vulnerability in the QEMU package that allows local guest OS users to cause a denial of service by consuming excessive host memory.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The main consequence of this vulnerability is a denial of service, which can lead to significant performance degradation of the host system due to high memory consumption.
You can update the QEMU package using the command 'apk add qemu@<fixed_version>' in your terminal, replacing <fixed_version> with the appropriate patched version.
The CVSS score of CVE-2017-5552 is 6.5, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for qemu.
