CVE-2014-0146

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2014-0146
The qcow2_open function in the (block/qcow2.c) in QEMU before 1.7.2 and 2.x before 2.0.0 allows local users to cause a denial of service (NULL pointer dereference) via a crafted image which causes an error, related to the initialization of the snapshot_offset and nb_snapshots fields.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector : AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

1.9 /10

CVSS v2.0 : LOW

V2 Legend

Vector : AV:L/AC:M/Au:N/C:N/I:N/A:P

Exploitability : 3.4 / Impact : 2.9

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References
Link Resource
http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=11b128f4062dd7f89b14abc8877ff20d41b28be9
http://rhn.redhat.com/errata/RHSA-2014-0420.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2014-0421.html Third Party Advisory
http://www.debian.org/security/2014/dsa-3044
http://www.openwall.com/lists/oss-security/2014/03/26/8 Mailing List Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1078232 Issue Tracking Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*
cpe:2.3:a:qemu:qemu:2.0.0:rc0:*:*:*:*:*:*
cpe:2.3:a:qemu:qemu:2.0.0:rc1:*:*:*:*:*:*
cpe:2.3:a:qemu:qemu:2.0.0:rc2:*:*:*:*:*:*
cpe:2.3:a:qemu:qemu:2.0.0:rc3:*:*:*:*:*:*
History

13 Feb 2023, 00:32

Type Values Removed Values Added
Summary CVE-2014-0146 Qemu: qcow2: NULL dereference in qcow2_open() error path The qcow2_open function in the (block/qcow2.c) in QEMU before 1.7.2 and 2.x before 2.0.0 allows local users to cause a denial of service (NULL pointer dereference) via a crafted image which causes an error, related to the initialization of the snapshot_offset and nb_snapshots fields.
References
  • {'url': 'https://access.redhat.com/errata/RHSA-2014:0435', 'name': 'https://access.redhat.com/errata/RHSA-2014:0435', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2014:0434', 'name': 'https://access.redhat.com/errata/RHSA-2014:0434', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/security/cve/CVE-2014-0146', 'name': 'https://access.redhat.com/security/cve/CVE-2014-0146', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2014:0420', 'name': 'https://access.redhat.com/errata/RHSA-2014:0420', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2014:0674', 'name': 'https://access.redhat.com/errata/RHSA-2014:0674', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2014:0421', 'name': 'https://access.redhat.com/errata/RHSA-2014:0421', 'tags': [], 'refsource': 'MISC'}

02 Feb 2023, 20:16

Type Values Removed Values Added
Summary The qcow2_open function in the (block/qcow2.c) in QEMU before 1.7.2 and 2.x before 2.0.0 allows local users to cause a denial of service (NULL pointer dereference) via a crafted image which causes an error, related to the initialization of the snapshot_offset and nb_snapshots fields. CVE-2014-0146 Qemu: qcow2: NULL dereference in qcow2_open() error path
References
  • {'url': 'http://git.qemu.org/?p=qemu.git;a=commit;h=11b128f4062dd7f89b14abc8877ff20d41b28be9', 'name': 'http://git.qemu.org/?p=qemu.git;a=commit;h=11b128f4062dd7f89b14abc8877ff20d41b28be9', 'tags': ['Third Party Advisory'], 'refsource': 'CONFIRM'}
  • (MISC) https://access.redhat.com/errata/RHSA-2014:0435 -
  • (MISC) https://access.redhat.com/errata/RHSA-2014:0434 -
  • (MISC) https://access.redhat.com/security/cve/CVE-2014-0146 -
  • (MISC) https://access.redhat.com/errata/RHSA-2014:0420 -
  • (MISC) https://access.redhat.com/errata/RHSA-2014:0674 -
  • (MISC) http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=11b128f4062dd7f89b14abc8877ff20d41b28be9 -
  • (MISC) https://access.redhat.com/errata/RHSA-2014:0421 -
Information

Published : 2017-08-10 15:29

Updated : 2023-12-10 12:15

NVD link : CVE-2014-0146

Mitre link : CVE-2014-0146

CVE.ORG link : CVE-2014-0146

JSON object : View

Products Affected

qemu

  • qemu
CWE
CWE-476

NULL Pointer Dereference