CVE-2017-10664

high-risk
Published 2017-08-02

qemu-nbd in QEMU (aka Quick Emulator) does not ignore SIGPIPE, which allows remote attackers to cause a denial of service (daemon crash) by disconnecting during a server-to-client reply attempt.

Do I need to act?

~
5.1% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.5/10 High
NETWORK / LOW complexity

Affected Products (20)

Affected Vendors

Debian Qemu Redhat

References (28)

Third Party Advisory http://www.debian.org/security/2017/dsa-3920
Mailing List http://www.openwall.com/lists/oss-security/2017/06/29/1
Third Party Advisory http://www.securityfocus.com/bid/99513
Third Party Advisory https://access.redhat.com/errata/RHSA-2017:2390
Third Party Advisory https://access.redhat.com/errata/RHSA-2017:2445
Third Party Advisory https://access.redhat.com/errata/RHSA-2017:3466
Third Party Advisory https://access.redhat.com/errata/RHSA-2017:3470
Third Party Advisory https://access.redhat.com/errata/RHSA-2017:3471
Third Party Advisory https://access.redhat.com/errata/RHSA-2017:3472
Third Party Advisory https://access.redhat.com/errata/RHSA-2017:3473
Third Party Advisory https://access.redhat.com/errata/RHSA-2017:3474
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1466190
Mailing List https://lists.debian.org/debian-lts-announce/2018/11/msg00038.html
Mailing List https://lists.gnu.org/archive/html/qemu-devel/2017-06/msg02693.html
Third Party Advisory http://www.debian.org/security/2017/dsa-3920
Mailing List http://www.openwall.com/lists/oss-security/2017/06/29/1
Third Party Advisory http://www.securityfocus.com/bid/99513
Third Party Advisory https://access.redhat.com/errata/RHSA-2017:2390
Third Party Advisory https://access.redhat.com/errata/RHSA-2017:2445
Third Party Advisory https://access.redhat.com/errata/RHSA-2017:3466
and 8 more references
55
/ 100
high-risk
Severity 26/34 · High
Exploitability 8/34 · Low
Exposure 21/34 · High