NVD Vulnerability Detail

CVE-2017-15119

Summary	The Network Block Device (NBD) server in Quick Emulator (QEMU) before 2.11 is vulnerable to a denial of service issue. It could occur if a client sent large option requests, making the server waste CPU time on reading up to 4GB per request. A client could use this flaw to keep the NBD server from serving other requests, resulting in DoS.
Publication Date	July 28, 2018, 1:29 a.m.
Registration Date	Jan. 26, 2021, 1:16 p.m.
Last Update	Nov. 21, 2024, 12:14 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:qemu:qemu::::::::					2.11.0

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:canonical:ubuntu_linux:16.04::::lts:::
cpe:2.3:o:canonical:ubuntu_linux:14.04::::lts:::
cpe:2.3:o:debian:debian_linux:9.0:::::::*
cpe:2.3:o:canonical:ubuntu_linux:17.10:::::::*
cpe:2.3:a:redhat:virtualization:4.0:::::::*

Related information, measures and tools

No	URL	タグ
1	http://www.openwall.com/lists/oss-security/2017/11/28/9	Mailing List Patch Third Party Advisory
2	http://www.openwall.com/lists/oss-security/2017/11/28/9	Mailing List Patch Third Party Advisory
3	http://www.securityfocus.com/bid/102011	Third Party Advisory VDB Entry
4	http://www.securityfocus.com/bid/102011	Third Party Advisory VDB Entry
5	https://access.redhat.com/errata/RHSA-2018:1104	Third Party Advisory
6	https://access.redhat.com/errata/RHSA-2018:1104	Third Party Advisory
7	https://access.redhat.com/errata/RHSA-2018:1113	Third Party Advisory
8	https://access.redhat.com/errata/RHSA-2018:1113	Third Party Advisory
9	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15119	Issue Tracking Patch Third Party Advisory
10	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15119	Issue Tracking Patch Third Party Advisory
11	https://lists.gnu.org/archive/html/qemu-devel/2017-11/msg05044.html	Mailing List Third Party Advisory
12	https://lists.gnu.org/archive/html/qemu-devel/2017-11/msg05044.html	Mailing List Third Party Advisory
13	https://usn.ubuntu.com/3575-1/	Third Party Advisory
14	https://usn.ubuntu.com/3575-1/	Third Party Advisory
15	https://www.debian.org/security/2018/dsa-4213	Third Party Advisory
16	https://www.debian.org/security/2018/dsa-4213	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-400	リソースの枯渇	https://cwe.mitre.org/data/definitions/400.html

JVN Vulnerability Information

Quick Emulator におけるリソースの枯渇に関する脆弱性

Title	Quick Emulator におけるリソースの枯渇に関する脆弱性
Summary	Quick Emulator (QEMU) には、リソースの枯渇に関する脆弱性が存在します。
Possible impacts	サービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Nov. 28, 2017, midnight
Registration Date	Oct. 17, 2018, 5:44 p.m.
Last Update	Oct. 17, 2018, 5:44 p.m.

Affected System

レッドハット

Red Hat Virtualization

Debian

Debian GNU/Linux

Canonical

Ubuntu

Fabrice Bellard

QEMU 2.11 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2017-15119	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15119
National Vulnerability Database (NVD)
2	CVE-2017-15119	https://nvd.nist.gov/vuln/detail/CVE-2017-15119
関連文書
3	CVE-2017-15119 Qemu: DoS via large option request	https://www.openwall.com/lists/oss-security/2017/11/28/9

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-400	https://cwe.mitre.org/data/definitions/400.html

ベンダー情報

No	Name	URL
Debian Security Advisory
1	DSA-4213	https://www.debian.org/security/2018/dsa-4213
Qemu-devel
2	[Qemu-devel] [PULL 1/2] nbd/server: CVE-2017-15119 Reject options larger	https://lists.gnu.org/archive/html/qemu-devel/2017-11/msg05044.html
Red Hat Bugzilla
3	Bug 1516925	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15119
Red Hat Security Advisory
4	RHSA-2018:1104	https://access.redhat.com/errata/RHSA-2018:1104
5	RHSA-2018:1113	https://access.redhat.com/errata/RHSA-2018:1113
Ubuntu Security Notice
6	USN-3575-1	https://usn.ubuntu.com/3575-1/

Change Log

No	Changed Details	Date of change
1	[2018年10月17日] 掲載	Oct. 17, 2018, 5:44 p.m.