Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.6
CVE-2017-15038: QEMU may let guest users read host memory
CVE-2017-15038 · published 9 years ago
Summary
The QEMU virtualization software has a timing issue that could let someone running inside a virtual machine see data from the host computer's memory. This could expose confidential information stored on the host. Updating QEMU to the latest version or applying the provided patch will fix the problem.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| qemu | qemu |
<= 2.9.1 cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:* |
Original advisory text
Race condition in the v9fs_xattrwalk function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS users to obtain sensitive information from host heap memory via vectors related to r...
Race condition in the v9fs_xattrwalk function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS users to obtain sensitive information from host heap memory via vectors related to reading extended attributes.
References
- http://www.openwall.com/lists/oss-security/2017/10/06/1 Mailing List Patch Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html
- https://lists.gnu.org/archive/html/qemu-devel/2017-10/msg00729.html Mailing List Patch Third Party Advisory
- https://usn.ubuntu.com/3575-1/
- https://www.debian.org/security/2018/dsa-4213
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Type
CWE-362Race Condition
Timeline
Published10 Oct 2017
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2017-15038 · NVD
Track software like this
Free during beta