QEMU Media Transfer Protocol usb_mtp_get_object/usb_mtp_get_partial_object input validation
CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
5.1 | $0-$5k | 0.00 |
A vulnerability has been found in QEMU (Virtualization Software) (affected version not known) and classified as critical. This vulnerability affects the function usb_mtp_get_object/usb_mtp_get_partial_object
of the component Media Transfer Protocol. The manipulation with an unknown input leads to a input validation vulnerability. The CWE definition for the vulnerability is CWE-20. The product receives input or data, but it does
not validate or incorrectly validates that the input has the
properties that are required to process the data safely and
correctly. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:
A flaw was found in qemu Media Transfer Protocol (MTP). The code opening files in usb_mtp_get_object and usb_mtp_get_partial_object and directories in usb_mtp_object_readdir doesn't consider that the underlying filesystem may have changed since the time lstat(2) was called in usb_mtp_object_alloc, a classical TOCTTOU problem. An attacker with write access to the host filesystem shared with a guest can use this property to navigate the host filesystem in the context of the QEMU process and read any file the QEMU process has access to. Access to the filesystem may be local or via a network share protocol such as CIFS.
The bug was discovered 12/14/2018. The weakness was presented 12/13/2018 by Michael Hanselmann as confirmed bug report (Bugzilla). The advisory is shared for download at bugzilla.redhat.com. This vulnerability was named CVE-2018-16872 since 09/11/2018. The attack can be initiated remotely. A single authentication is required for exploitation. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 06/19/2023).
The commercial vulnerability scanner Qualys is able to test this issue with plugin 157908 (Oracle Enterprise Linux Security Update for qemu (ELSA-2019-4518)).
There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.
Product
Type
Name
License
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔍VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 5.1VulDB Meta Temp Score: 5.1
VulDB Base Score: 5.0
VulDB Temp Score: 5.0
VulDB Vector: 🔍
VulDB Reliability: 🔍
NVD Base Score: 5.3
NVD Vector: 🔍
CNA Base Score: 5.0
CNA Vector (Red Hat, Inc.): 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Input validationCWE: CWE-20
CAPEC: 🔍
ATT&CK: 🔍
Local: No
Remote: Yes
Availability: 🔍
Status: Not defined
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Qualys ID: 🔍
Qualys Name: 🔍
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: no mitigation knownStatus: 🔍
0-Day Time: 🔍
Timeline
09/11/2018 🔍12/13/2018 🔍
12/13/2018 🔍
12/13/2018 🔍
12/14/2018 🔍
12/14/2018 🔍
06/19/2023 🔍
Sources
Product: qemu.orgAdvisory: USN-3923-1
Researcher: Michael Hanselmann
Status: Confirmed
Confirmation: 🔍
CVE: CVE-2018-16872 (🔍)
SecurityFocus: 106212 - QEMU CVE-2018-16872 Directory Traversal Vulnerability
Entry
Created: 12/14/2018 07:48Updated: 06/19/2023 08:08
Changes: 12/14/2018 07:48 (61), 04/20/2020 20:34 (5), 06/19/2023 08:05 (3), 06/19/2023 08:08 (10)
Complete: 🔍
Cache ID: 3:03E:103
No comments yet. Languages: en.
Please log in to comment.