CVE-2017-5987

The sdhci_sdma_transfer_multi_blocks function in hw/sd/sdhci.c in QEMU (aka Quick Emulator) allows local OS guest privileged users to cause a denial of service (infinite loop and QEMU process crash) via vectors involving the transfer mode register during multi block transfer.

Weakness

The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Affected Software

Name	Vendor	Start Version	End Version
Qemu	Qemu	*	2.8.1.1 (including)
Qemu	Qemu	2.9.0-rc0 (including)	2.9.0-rc0 (including)
Qemu	Qemu	2.9.0-rc1 (including)	2.9.0-rc1 (including)
Qemu	Qemu	2.9.0-rc2 (including)	2.9.0-rc2 (including)
Qemu	Qemu	2.9.0-rc3 (including)	2.9.0-rc3 (including)
Qemu	Qemu	2.9.0-rc4 (including)	2.9.0-rc4 (including)
Qemu	Ubuntu	artful	*
Qemu	Ubuntu	bionic	*
Qemu	Ubuntu	cosmic	*
Qemu	Ubuntu	devel	*
Qemu	Ubuntu	disco	*
Qemu	Ubuntu	eoan	*
Qemu	Ubuntu	esm-infra-legacy/trusty	*
Qemu	Ubuntu	esm-infra/bionic	*
Qemu	Ubuntu	esm-infra/focal	*
Qemu	Ubuntu	esm-infra/xenial	*
Qemu	Ubuntu	focal	*
Qemu	Ubuntu	groovy	*
Qemu	Ubuntu	hirsute	*
Qemu	Ubuntu	trusty	*
Qemu	Ubuntu	trusty/esm	*
Qemu	Ubuntu	upstream	*
Qemu	Ubuntu	xenial	*
Qemu	Ubuntu	yakkety	*
Qemu	Ubuntu	zesty	*
Qemu-kvm	Ubuntu	precise	*
Qemu-kvm	Ubuntu	precise/esm	*
Qemu-kvm	Ubuntu	upstream	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2017-5987
CWE	https://cwe.mitre.org/data/definitions/835.html

Loop with Unreachable Exit Condition ('Infinite Loop')

Weakness

Affected Software

References