Memory Leak Vulnerability in QEMU Package Leading to Denial of Service
Summary
ALPINE-CVE-2017-5578: Memory leak in the virtio_gpu_resource_attach_backing function in hw/display/virtio-gpu.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (host memory consumption) via a large number... Affects qemu versions < 2.8.1-r1. Fixed in 2.8.1-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
QEMU, or Quick Emulator, is an open-source machine emulator and virtualizer that enables users to run multiple operating systems on a single host. It is widely used for virtualization, allowing for the creation and management of virtual machines. The package is known for its flexibility and support for various architectures. However, it has been identified to have a vulnerability that can lead to significant memory consumption, affecting the host system's performance.
Vulnerability Detail
The vulnerability, identified as CVE-2017-5578, originates from a memory leak in the virtio_gpu_resource_attach_backing function located in hw/display/virtio-gpu.c. This flaw allows local guest OS users to exploit the system by sending a large number of VIRTIO_GPU_CMD_RESOURCE_ATTACH_BACKING commands, which can lead to a denial of service due to excessive host memory consumption. The severity of this vulnerability is rated with a CVSS score of 6.5, indicating a moderate risk to system stability and performance.
How To Fix
Minimum fixed version
2.8.1-r1
This is the first release that contains the fix.
sudo apk add --upgrade qemuTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider limiting the number of VIRTIO_GPU_CMD_RESOURCE_ATTACH_BACKING commands that can be executed by guest OS users to mitigate the impact of this vulnerability until a patch is applied.
Conclusion
The memory leak vulnerability in the QEMU package poses a moderate risk to system performance due to potential denial of service. It is crucial to apply the recommended updates to mitigate this issue and ensure the stability of your virtualized environments.
See every vulnerability recorded for qemu →
FAQ
CVE-2017-5578 is a vulnerability in the QEMU package that allows local guest OS users to cause a denial of service by exploiting a memory leak.
This vulnerability can lead to excessive memory consumption on the host system, potentially causing performance degradation or crashes.
Affected versions include QEMU prior to 2.8.1.1-r0 for Alpine v3.5 and prior to 2.8.1-r1 for Alpine v3.6, v3.7, v3.8, v3.9, and v3.10.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Vulert is a service that monitors and alerts for open-source vulnerabilities in software using just a manifest file like package-lock.json, providing real-time insights.
References
Related vulnerabilities
Recent vulnerabilities recorded for qemu.
