CVE-2014-7840

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2014-7840
The host_from_stream_offset function in arch_init.c in QEMU, when loading RAM during migration, allows remote attackers to execute arbitrary code via a crafted (1) offset or (2) length value in savevm data.

7.5 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability : 10.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References
Link Resource
http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=0be839a2701369f669532ea5884c15bead1c6e08
http://rhn.redhat.com/errata/RHSA-2015-0349.html Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-0624.html Third Party Advisory
http://thread.gmane.org/gmane.comp.emulators.qemu/306117 Broken Link
https://bugzilla.redhat.com/show_bug.cgi?id=1163075 Issue Tracking Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/99194 Third Party Advisory VDB Entry
Configurations

Configuration 1 (hide)

cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:7.3:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:7.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:7.5:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.3:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:*:*

Configuration 3 (hide)

AND
cpe:2.3:a:redhat:virtualization:3.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
History

13 Feb 2023, 00:42

Type Values Removed Values Added
Summary It was found that certain values that were read when loading RAM during migration were not validated. A user able to alter the savevm data (either on the disk or over the wire during migration) could use either of these flaws to corrupt QEMU process memory on the (destination) host, which could potentially result in arbitrary code execution on the host with the privileges of the QEMU process. The host_from_stream_offset function in arch_init.c in QEMU, when loading RAM during migration, allows remote attackers to execute arbitrary code via a crafted (1) offset or (2) length value in savevm data.
References
  • {'url': 'https://access.redhat.com/security/cve/CVE-2014-7840', 'name': 'https://access.redhat.com/security/cve/CVE-2014-7840', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2015:0349', 'name': 'https://access.redhat.com/errata/RHSA-2015:0349', 'tags': [], 'refsource': 'MISC'}
  • {'url': 'https://access.redhat.com/errata/RHSA-2015:0624', 'name': 'https://access.redhat.com/errata/RHSA-2015:0624', 'tags': [], 'refsource': 'MISC'}

02 Feb 2023, 20:18

Type Values Removed Values Added
References
  • {'url': 'http://git.qemu.org/?p=qemu.git;a=commit;h=0be839a2701369f669532ea5884c15bead1c6e08', 'name': 'http://git.qemu.org/?p=qemu.git;a=commit;h=0be839a2701369f669532ea5884c15bead1c6e08', 'tags': ['Patch', 'Vendor Advisory'], 'refsource': 'CONFIRM'}
  • (MISC) http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=0be839a2701369f669532ea5884c15bead1c6e08 -
  • (MISC) https://access.redhat.com/security/cve/CVE-2014-7840 -
  • (MISC) https://access.redhat.com/errata/RHSA-2015:0349 -
  • (MISC) https://access.redhat.com/errata/RHSA-2015:0624 -
Summary The host_from_stream_offset function in arch_init.c in QEMU, when loading RAM during migration, allows remote attackers to execute arbitrary code via a crafted (1) offset or (2) length value in savevm data. It was found that certain values that were read when loading RAM during migration were not validated. A user able to alter the savevm data (either on the disk or over the wire during migration) could use either of these flaws to corrupt QEMU process memory on the (destination) host, which could potentially result in arbitrary code execution on the host with the privileges of the QEMU process.
Information

Published : 2014-12-12 15:59

Updated : 2023-12-10 11:31

NVD link : CVE-2014-7840

Mitre link : CVE-2014-7840

CVE.ORG link : CVE-2014-7840

JSON object : View

Products Affected

redhat

  • enterprise_linux_server_aus
  • enterprise_linux_workstation
  • virtualization
  • enterprise_linux_desktop
  • enterprise_linux_eus
  • enterprise_linux_server
  • enterprise_linux

qemu

  • qemu
CWE
CWE-20

Improper Input Validation