Strix
26.1K

CVE-2017-7539

UnknownEPSS 5.53%

Last modified

CVE-2017-7539 is a vulnerability of currently unknown severity. An assertion-failure flaw was found in Qemu before 2.10.1, in the Network Block Device (NBD) server's initial connection negotiation, where the I/O coroutine was undefined. This could crash the qemu-nbd server if a client sent unexpected data during connection negotiation. EPSS estimates a 5.53% chance of exploitation in the next 30 days.

Description

An assertion-failure flaw was found in Qemu before 2.10.1, in the Network Block Device (NBD) server's initial connection negotiation, where the I/O coroutine was undefined. This could crash the qemu-nbd server if a client sent unexpected data during connection negotiation. A remote user or process could use this flaw to crash the qemu-nbd server resulting in denial of service.

Metrics

EPSS Probability
5.53%

91.8th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
QemuQemu< 2.10.1
RedhatOpenstack6.0
RedhatOpenstack7.0
RedhatOpenstack8
RedhatOpenstack9
RedhatOpenstack10
RedhatOpenstack11
RedhatVirtualization4.0
RedhatVirtualization3.0

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2017-7539?
An assertion-failure flaw was found in Qemu before 2.10.1, in the Network Block Device (NBD) server's initial connection negotiation, where the I/O coroutine was undefined. This could crash the qemu-nbd server if a client sent unexpected data during connection negotiation. A remote user or process could use this flaw to crash the qemu-nbd server resulting in denial of service.
How severe is CVE-2017-7539?
Severity scoring for CVE-2017-7539 is pending analysis. The EPSS model estimates a 5.53% probability of exploitation in the next 30 days.
How do I fix CVE-2017-7539?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2017-7539?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST