NVD Vulnerability Detail

CVE-2014-0143

Summary	Multiple integer overflows in the block drivers in QEMU, possibly before 2.0.0, allow local users to cause a denial of service (crash) via a crafted catalog size in (1) the parallels_open function in block/parallels.c or (2) bochs_open function in bochs.c, a large L1 table in the (3) qcow2_snapshot_load_tmp in qcow2-snapshot.c or (4) qcow2_grow_l1_table function in qcow2-cluster.c, (5) a large request in the bdrv_check_byte_request function in block.c and other block drivers, (6) crafted cluster indexes in the get_refcount function in qcow2-refcount.c, or (7) a large number of blocks in the cloop_open function in cloop.c, which trigger buffer overflows, memory corruption, large memory allocations and out-of-bounds read and writes.
Publication Date	Aug. 11, 2017, 12:29 a.m.
Registration Date	Jan. 26, 2021, 3:04 p.m.
Last Update	Nov. 21, 2024, 11:01 a.m.

CVSS3.0 : HIGH
スコア	7.0
Vector	CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
攻撃元区分(AV)	ローカル
攻撃条件の複雑さ(AC)	高
攻撃に必要な特権レベル(PR)	低
利用者の関与(UI)	不要
影響の想定範囲(S)	変更なし
機密性への影響(C)	高
完全性への影響(I)	高
可用性への影響(A)	高

CVSS2.0 : MEDIUM
Score	4.4
Vector	AV:L/AC:M/Au:N/C:P/I:P/A:P
攻撃元区分(AV)	ローカル
攻撃条件の複雑さ(AC)	中
攻撃前の認証要否(Au)	不要
機密性への影響(C)	低
完全性への影響(I)	低
可用性への影響(A)	低
Get all privileges.	いいえ
Get user privileges	いいえ
Get other privileges	いいえ
User operation required	いいえ

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:o:redhat:enterprise_linux:6.0:::::::*

Configuration2		or higher	or less	more than	less than
cpe:2.3:a:qemu:qemu::::::::			1.7.1

Related information, measures and tools

No	URL	タグ
1	http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=509a41bab5306181044b5fff02eadf96d9c8676a
2	http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=509a41bab5306181044b5fff02eadf96d9c8676a
3	http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=6a83f8b5bec6f59e56cc49bd49e4c3f8f805d56f
4	http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=6a83f8b5bec6f59e56cc49bd49e4c3f8f805d56f
5	http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=8f4754ede56e3f9ea3fd7207f4a7c4453e59285b
6	http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=8f4754ede56e3f9ea3fd7207f4a7c4453e59285b
7	http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=afbcc40bee4ef51731102d7d4b499ee12fc182e1
8	http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=afbcc40bee4ef51731102d7d4b499ee12fc182e1
9	http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=cab60de930684c33f67d4e32c7509b567f8c445b
10	http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=cab60de930684c33f67d4e32c7509b567f8c445b
11	http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=db8a31d11d6a60f48d6817530640d75aa72a9a2f
12	http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=db8a31d11d6a60f48d6817530640d75aa72a9a2f
13	http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=e3737b820b45e54b059656dc3f914f895ac7a88b
14	http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=e3737b820b45e54b059656dc3f914f895ac7a88b
15	http://rhn.redhat.com/errata/RHSA-2014-0420.html	Third Party Advisory
16	http://rhn.redhat.com/errata/RHSA-2014-0420.html	Third Party Advisory
17	http://rhn.redhat.com/errata/RHSA-2014-0421.html	Third Party Advisory
18	http://rhn.redhat.com/errata/RHSA-2014-0421.html	Third Party Advisory
19	http://www.debian.org/security/2014/dsa-3044
20	http://www.debian.org/security/2014/dsa-3044
21	https://bugzilla.redhat.com/show_bug.cgi?id=1079140	Issue Tracking Patch Third Party Advisory
22	https://bugzilla.redhat.com/show_bug.cgi?id=1079140	Issue Tracking Patch Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-190	整数オーバーフローまたはラップアラウンド	https://cwe.mitre.org/data/definitions/190.html

JVN Vulnerability Information

QEMU における整数オーバーフローの脆弱性

Title	QEMU における整数オーバーフローの脆弱性
Summary	QEMU には、整数オーバーフローの脆弱性が存在します。
Possible impacts	情報を取得される、情報を改ざんされる、およびサービス運用妨害 (DoS) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	April 1, 2014, midnight
Registration Date	Sept. 15, 2017, 3:39 p.m.
Last Update	Sept. 15, 2017, 3:39 p.m.

Affected System

レッドハット

Red Hat Enterprise Linux

Fabrice Bellard

QEMU 2.0.0 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2014-0143	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0143
National Vulnerability Database (NVD)
2	CVE-2014-0143	https://nvd.nist.gov/vuln/detail/CVE-2014-0143

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-190	https://cwe.mitre.org/data/definitions/190.html

ベンダー情報

No	Name	URL
QEMU
1	block/cloop: prevent offsets_size integer overflow (CVE-2014-0143)	https://git.qemu.org/?p=qemu.git;a=commit;h=509a41bab5306181044b5fff02eadf96d9c8676a
2	block: Limit request size (CVE-2014-0143)	https://git.qemu.org/?p=qemu.git;a=commit;h=8f4754ede56e3f9ea3fd7207f4a7c4453e59285b
3	bochs: Check catalog_size header field (CVE-2014-0143)	https://git.qemu.org/?p=qemu.git;a=commit;h=e3737b820b45e54b059656dc3f914f895ac7a88b
4	parallels: Fix catalog size integer overflow (CVE-2014-0143)	https://git.qemu.org/?p=qemu.git;a=commit;h=afbcc40bee4ef51731102d7d4b499ee12fc182e1
5	qcow2: Avoid integer overflow in get_refcount (CVE-2014-0143)	https://git.qemu.org/?p=qemu.git;a=commit;h=db8a31d11d6a60f48d6817530640d75aa72a9a2f
6	qcow2: Check maximum L1 size in qcow2_snapshot_load_tmp() (CVE-2014-0143)	https://git.qemu.org/?p=qemu.git;a=commit;h=6a83f8b5bec6f59e56cc49bd49e4c3f8f805d56f
7	qcow2: Fix new L1 table size check (CVE-2014-0143)	https://git.qemu.org/?p=qemu.git;a=commit;h=cab60de930684c33f67d4e32c7509b567f8c445b
Red Hat Bugzilla
8	Bug 1079140	https://bugzilla.redhat.com/show_bug.cgi?id=1079140
Red Hat Security Advisory
9	RHSA-2014:0420	https://access.redhat.com/errata/RHSA-2014:0420
10	RHSA-2014:0421	https://access.redhat.com/errata/RHSA-2014:0421

Change Log

No	Changed Details	Date of change
0	[2017年09月15日] 掲載	Feb. 17, 2018, 10:37 a.m.