Memory Leak Vulnerability in QEMU Package Leading to Denial of Service
Summary
ALPINE-CVE-2017-5579: Memory leak in the serial_exit_core function in hw/char/serial.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption and QEMU process crash) via a lar... Affects qemu versions < 2.8.1-r1. Fixed in 2.8.1-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
QEMU, short for Quick Emulator, is an open-source machine emulator and virtualizer that enables users to run multiple operating systems on a single host. It is widely used for virtualization and emulation purposes, providing a flexible and efficient environment for developers and system administrators. However, QEMU has been found to have a memory leak vulnerability that can be exploited by local guest OS privileged users, leading to potential denial of service.
Vulnerability Detail
The vulnerability, identified as CVE-2017-5579, originates from a memory leak in the serial_exit_core function located in hw/char/serial.c. This flaw allows local privileged users of the guest operating system to perform a large number of device unplug operations, which can exhaust the host's memory resources. As a result, this can lead to the QEMU process crashing, causing a denial of service. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
Minimum fixed version
2.8.1-r1
This is the first release that contains the fix.
sudo apk add --upgrade qemuTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, limit the number of device unplug operations that can be performed by privileged users in the guest OS to mitigate the risk of memory exhaustion.
Conclusion
In summary, CVE-2017-5579 is a memory leak vulnerability in the QEMU package that can lead to denial of service due to excessive memory consumption. It is crucial for users to update their QEMU installations to the patched versions to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in your software.
See every vulnerability recorded for qemu →
FAQ
CVE-2017-5579 is a vulnerability in the QEMU package that allows local guest OS privileged users to cause a denial of service through a memory leak.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The main consequence is a denial of service, where the QEMU process can crash due to excessive memory consumption, impacting the availability of the virtualized environment.
Yes, patches are available for various Alpine Linux versions. Ensure to update to the specified patched version of QEMU to mitigate the vulnerability.
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for qemu.
