Lucene search

RedhatCVE-2017-7493

HistoryMay 17, 2017 - 3:29 p.m.

CVE-2017-7493

2017-05-1715:29:00

CWE-732

redhat

web.nvd.nist.gov

cve-2017-7493

quick emulator

qemu

virtfs

9pfs

improper access control

escalation of privileges

security vulnerability

nvd

CVSS2

4.6

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AI Score

8.3

Confidence

High

EPSS

0.001

Percentile

26.7%

JSON

Quick Emulator (Qemu) built with the VirtFS, host directory sharing via Plan 9 File System(9pfs) support, is vulnerable to an improper access control issue. It could occur while accessing virtfs metadata files in mapped-file security mode. A guest user could use this flaw to escalate their privileges inside guest.

Affected configurations

Nvd

Vulners

Node

qemuqemuRange≤2.9.1

Node

debiandebian_linuxMatch8.0

VendorProductVersionCPE
qemuqemu*cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*
debiandebian_linux8.0cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
qemu	qemu	*	cpe:2.3:a:qemu:qemu::::::::
debian	debian_linux	8.0	cpe:2.3:o:debian:debian_linux:8.0:::::::*

CNA Affected

[
  {
    "product": "qemu",
    "vendor": "QEMU",
    "versions": [
      {
        "status": "affected",
        "version": "2.7.4"
      }
    ]
  }
]