4.6
CVSSv2

CVE-2019-6778

Published: 21/03/2019 Updated: 07/11/2023
CVSS v2 Base Score: 4.6 | Impact Score: 6.4 | Exploitability Score: 3.9
CVSS v3 Base Score: 7.8 | Impact Score: 5.9 | Exploitability Score: 1.8
VMScore: 410
Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Summary

In QEMU 3.0.0, tcp_emu in slirp/tcp_subr.c has a heap-based buffer overflow.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

qemu qemu 3.0.0

opensuse leap 42.3

opensuse leap 15.0

fedoraproject fedora 29

fedoraproject fedora 30

canonical ubuntu linux 16.04

canonical ubuntu linux 14.04

canonical ubuntu linux 18.04

canonical ubuntu linux 18.10

Vendor Advisories

Several security issues were fixed in QEMU ...
Synopsis Important: qemu-kvm security update Type/Severity Security Advisory: Important Topic An update for qemu-kvm is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base scor ...
Synopsis Important: qemu-kvm-rhev security and bug fix update Type/Severity Security Advisory: Important Topic An update for qemu-kvm-rhev is now available for Red Hat Virtualization for Red Hat Virtualization Host 7Red Hat Product Security has rated this update as having a Important security impact A Com ...
Synopsis Important: qemu-kvm-rhev security and bug fix update Type/Severity Security Advisory: Important Topic An update for qemu-kvm-rhev is now available for Red Hat OpenStack Platform 100 (Newton), Red Hat OpenStack Platform 130 (Queens), and Red Hat OpenStack Platform 140 (Rocky)Red Hat Product Secu ...
Synopsis Important: qemu-kvm security update Type/Severity Security Advisory: Important Topic An update for qemu-kvm is now available for Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base scor ...
Multiple security issues were discovered in QEMU, a fast processor emulator, which could result in denial of service, the execution of arbitrary code or information disclosure In addition this update backports support to passthrough the new md-clear CPU flag added in the intel-microcode update shipped in DSA 4447 to x86-based guests For the stabl ...
Debian Bug report logs - #916442 qemu: CVE-2018-20123 Package: src:qemu; Maintainer for src:qemu is Debian QEMU Team <pkg-qemu-devel@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Fri, 14 Dec 2018 14:12:02 UTC Severity: minor Tags: security, upstream Found in versions qemu/1:3 ...
Debian Bug report logs - #920222 qemu: CVE-2019-6501: scsi-generic: possible OOB access while handling inquiry request Package: src:qemu; Maintainer for src:qemu is Debian QEMU Team <pkg-qemu-devel@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 22 Jan 2019 20:33:02 UTC Seve ...
Debian Bug report logs - #921525 CVE-2019-6778 slirp: heap buffer overflow in tcp_emu() Package: src:qemu; Maintainer for src:qemu is Debian QEMU Team <pkg-qemu-devel@listsaliothdebianorg>; Reported by: Michael Tokarev <mjt@tlsmskru> Date: Wed, 6 Feb 2019 14:18:02 UTC Severity: important Tags: patch, security, ...
Debian Bug report logs - #929353 qemu: CVE-2019-12155: qxl: null pointer dereference while releasing speice resources Package: src:qemu; Maintainer for src:qemu is Debian QEMU Team <pkg-qemu-devel@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Wed, 22 May 2019 08:03:02 UTC Sever ...
Debian Bug report logs - #901017 qemu: CVE-2018-11806: slirp: heap buffer overflow while reassembling fragmented datagrams Package: src:qemu; Maintainer for src:qemu is Debian QEMU Team <pkg-qemu-devel@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Fri, 8 Jun 2018 03:42:01 UTC ...
Impact: Important Public Date: 2019-01-11 CWE: CWE-122 Bugzilla: 1664205: CVE-2019-6778 QEMU: slirp: he ...

Github Repositories

qemu-vm-escape This is an exploit for CVE-2019-6778, a heap buffer overflow in slirp:tcp_emu() For more information, see the writeup (Sorry, only Chinese version available now) and the slides for the talk in Tensec 2019 by Marco and me Environment $ /qemu-system-x86_64 --version QEMU emulator version 3150 (v310-456-g9b2e891ec5-dirty) Copyright (c) 2003-2018 Fabrice Bella

qemu-vm-escape This is an exploit for CVE-2019-6778, a heap buffer overflow in slirp:tcp_emu() For more information, see the writeup (Sorry, only Chinese version available now) and the slides for the talk in Tensec 2019 by Marco and me Environment $ /qemu-system-x86_64 --version QEMU emulator version 3150 (v310-456-g9b2e891ec5-dirty) Copyright (c) 2003-2018 Fabrice Bella

vnctf2024 escape_langlang_mountain2 wp 前言 用户态的题实在想不出新的点子,去年的VNCTF有qemu逃逸,所以今年继续沿用,正好自己也复现过一些qemu的CVE。 在以往的qemu逃逸题中似乎很少有用伪造QEMUTimer结构体去劫持控制流的方法,本人也只在hfctf2022的hfdev和qwb2019的ExecChrome遇到过,不过它们都是使