CVE-2017-15118
A stack-based buffer overflow vulnerability was found in NBD server implementation in qemu before...
A stack-based buffer overflow vulnerability was found in NBD server implementation in qemu before 2.11 allowing a client to request an export name of size up to 4096 bytes, which in fact should be limited to 256 bytes, causing an out-of-bounds stack write in the qemu process. If NBD server requires TLS, the attacker cannot trigger the buffer overflow without first successfully negotiating TLS.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
A stack-based buffer overflow vulnerability was found in NBD server implementation in qemu before 2.11 allowing a client to request an export name of size up to 4096 bytes, which in fact should be limited to 256 bytes, causing an out-of-bounds stack write in the qemu process. If NBD server requires TLS, the attacker cannot trigger the buffer overflow without first successfully negotiating TLS.
- Record
CVE-2017-15118- CVSS 3.0
- 8.3 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - Weakness
- CWE-121
- Updated
- 2026-11-02
EUVDEUVD-2017-6579
A stack-based buffer overflow vulnerability was found in NBD server implementation in qemu before 2.11 allowing a client to request an export name of size up to 4096 bytes, which in fact should be limited to 256 bytes, causing an out-of-bounds stack write in the qemu process. If NBD server requires TLS, the attacker cannot trigger the buffer overflow without first successfully negotiating TLS.
- Record
EUVD-2017-6579- CVSS 3.0
- 8.3 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p8q8-xqgv-rwvr
A stack-based buffer overflow vulnerability was found in NBD server implementation in qemu before...
A stack-based buffer overflow vulnerability was found in NBD server implementation in qemu before 2.11 allowing a client to request an export name of size up to 4096 bytes, which in fact should be limited to 256 bytes, causing an out-of-bounds stack write in the qemu process. If NBD server requires TLS, the attacker cannot trigger the buffer overflow without first successfully negotiating TLS.
- Record
GHSA-p8q8-xqgv-rwvr- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-787
- Updated
- 2026-11-02
NVD
A stack-based buffer overflow vulnerability was found in NBD server implementation in qemu before 2.11 allowing a client to request an export name of size up to 4096 bytes, which in fact should be limited to 256 bytes, causing an out-of-bounds stack write in the qemu process. If NBD server requires TLS, the attacker cannot trigger the buffer overflow without first successfully negotiating TLS.
- Record
CVE-2017-15118- CVSS 3.0
- 8.3 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-121, CWE-787
- Updated
- 2026-11-02
OSVBELL-CVE-2017-15118
CVE-2017-15118 does not affect BellSoft software
- Record
BELL-CVE-2017-15118- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
A stack-based buffer overflow vulnerability was found in NBD server implementation in qemu before 2.11 allowing a client to request an export name of size up to 4096 bytes, which in fact should be limited to 256 bytes, causing an out-of-bounds stack write in the qemu process. If NBD server requires TLS, the attacker cannot trigger the buffer overflow without first successfully negotiating TLS.
- Record
CVE-2017-15118- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2017-15118
A stack-based buffer overflow vulnerability was found in NBD server implementation in qemu before 2.11 allowing a client to request an export name of size up to 4096 bytes, which in fact should be limited to 256 bytes, causing an out-of-bounds stack write in the qemu process. If NBD server requires TLS, the attacker cannot trigger the buffer overflow without first successfully negotiating TLS.
- Record
DEBIAN-CVE-2017-15118- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVRHSA-2018:1104
Red Hat Security Advisory: qemu-kvm-rhev security, bug fix, and enhancement update
- Record
RHSA-2018:1104- CVSS 3.0
- 8.3 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - Updated
- 2026-11-02
OSVRHSA-2018:1113
Red Hat Security Advisory: qemu-kvm-rhev security and bug fix update
- Record
RHSA-2018:1113- CVSS 3.0
- 8.3 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11287-1 No score
qemu-6.1.0-32.1 on GA media
These are all security issues fixed in the qemu-6.1.0-32.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11287-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
qemuDebian:12 |
before 1:2.11+dfsg-1 | 1:2.11+dfsg-1 |
qemuDebian:13 |
before 1:2.11+dfsg-1 | 1:2.11+dfsg-1 |
qemuDebian:14 |
before 1:2.11+dfsg-1 | 1:2.11+dfsg-1 |
qemu-img-rhevRed Hat:enterprise_linux:7::hypervisor From an advisory covering 8 CVEs |
before 10:2.10.0-21.el7 | 10:2.10.0-21.el7 |
qemu-kvm-common-rhevRed Hat:enterprise_linux:7::hypervisor From an advisory covering 8 CVEs |
before 10:2.10.0-21.el7 | 10:2.10.0-21.el7 |
qemu-kvm-rhevRed Hat:enterprise_linux:7::hypervisor From an advisory covering 8 CVEs |
before 10:2.10.0-21.el7 | 10:2.10.0-21.el7 |
qemu-kvm-rhev-debuginfoRed Hat:enterprise_linux:7::hypervisor From an advisory covering 8 CVEs |
before 10:2.10.0-21.el7 | 10:2.10.0-21.el7 |
qemu-kvm-tools-rhevRed Hat:enterprise_linux:7::hypervisor From an advisory covering 8 CVEs |
before 10:2.10.0-21.el7 | 10:2.10.0-21.el7 |
qemu-img-rhevRed Hat:openstack:10::el7 From an advisory covering 8 CVEs |
before 10:2.10.0-21.el7 | 10:2.10.0-21.el7 |
qemu-kvm-common-rhevRed Hat:openstack:10::el7 From an advisory covering 8 CVEs |
before 10:2.10.0-21.el7 | 10:2.10.0-21.el7 |
Show 24 moreShow less
| Package | Affected | Fixed |
|---|---|---|
qemu-kvm-rhevRed Hat:openstack:10::el7 From an advisory covering 8 CVEs |
before 10:2.10.0-21.el7 | 10:2.10.0-21.el7 |
qemu-kvm-rhev-debuginfoRed Hat:openstack:10::el7 From an advisory covering 8 CVEs |
before 10:2.10.0-21.el7 | 10:2.10.0-21.el7 |
qemu-kvm-tools-rhevRed Hat:openstack:10::el7 From an advisory covering 8 CVEs |
before 10:2.10.0-21.el7 | 10:2.10.0-21.el7 |
qemu-img-rhevRed Hat:openstack:11::el7 From an advisory covering 8 CVEs |
before 10:2.10.0-21.el7 | 10:2.10.0-21.el7 |
qemu-kvm-common-rhevRed Hat:openstack:11::el7 From an advisory covering 8 CVEs |
before 10:2.10.0-21.el7 | 10:2.10.0-21.el7 |
qemu-kvm-rhevRed Hat:openstack:11::el7 From an advisory covering 8 CVEs |
before 10:2.10.0-21.el7 | 10:2.10.0-21.el7 |
qemu-kvm-rhev-debuginfoRed Hat:openstack:11::el7 From an advisory covering 8 CVEs |
before 10:2.10.0-21.el7 | 10:2.10.0-21.el7 |
qemu-kvm-tools-rhevRed Hat:openstack:11::el7 From an advisory covering 8 CVEs |
before 10:2.10.0-21.el7 | 10:2.10.0-21.el7 |
qemu-img-rhevRed Hat:openstack:12::el7 From an advisory covering 8 CVEs |
before 10:2.10.0-21.el7 | 10:2.10.0-21.el7 |
qemu-kvm-common-rhevRed Hat:openstack:12::el7 From an advisory covering 8 CVEs |
before 10:2.10.0-21.el7 | 10:2.10.0-21.el7 |
qemu-kvm-rhevRed Hat:openstack:12::el7 From an advisory covering 8 CVEs |
before 10:2.10.0-21.el7 | 10:2.10.0-21.el7 |
qemu-kvm-rhev-debuginfoRed Hat:openstack:12::el7 From an advisory covering 8 CVEs |
before 10:2.10.0-21.el7 | 10:2.10.0-21.el7 |
qemu-kvm-tools-rhevRed Hat:openstack:12::el7 From an advisory covering 8 CVEs |
before 10:2.10.0-21.el7 | 10:2.10.0-21.el7 |
qemu-img-rhevRed Hat:openstack:8::el7 From an advisory covering 8 CVEs |
before 10:2.10.0-21.el7 | 10:2.10.0-21.el7 |
qemu-kvm-common-rhevRed Hat:openstack:8::el7 From an advisory covering 8 CVEs |
before 10:2.10.0-21.el7 | 10:2.10.0-21.el7 |
qemu-kvm-rhevRed Hat:openstack:8::el7 From an advisory covering 8 CVEs |
before 10:2.10.0-21.el7 | 10:2.10.0-21.el7 |
qemu-kvm-rhev-debuginfoRed Hat:openstack:8::el7 From an advisory covering 8 CVEs |
before 10:2.10.0-21.el7 | 10:2.10.0-21.el7 |
qemu-kvm-tools-rhevRed Hat:openstack:8::el7 From an advisory covering 8 CVEs |
before 10:2.10.0-21.el7 | 10:2.10.0-21.el7 |
qemu-img-rhevRed Hat:openstack:9::el7 From an advisory covering 8 CVEs |
before 10:2.10.0-21.el7 | 10:2.10.0-21.el7 |
qemu-kvm-common-rhevRed Hat:openstack:9::el7 From an advisory covering 8 CVEs |
before 10:2.10.0-21.el7 | 10:2.10.0-21.el7 |
qemu-kvm-rhevRed Hat:openstack:9::el7 From an advisory covering 8 CVEs |
before 10:2.10.0-21.el7 | 10:2.10.0-21.el7 |
qemu-kvm-rhev-debuginfoRed Hat:openstack:9::el7 From an advisory covering 8 CVEs |
before 10:2.10.0-21.el7 | 10:2.10.0-21.el7 |
qemu-kvm-tools-rhevRed Hat:openstack:9::el7 From an advisory covering 8 CVEs |
before 10:2.10.0-21.el7 | 10:2.10.0-21.el7 |
qemuopenSUSE:Tumbleweed From an advisory covering 135 CVEs |
before 6.1.0-32.1 | 6.1.0-32.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | QEMU - NBD Server Long Export Name Stack Buffer Overflow | 2017-11-29 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-15118 is a high vulnerability (CVSS 8.3) in Qemu, published July 27, 2018. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 11.9%, the 96th percentile. Fixed in qemu 1:2.11+dfsg-1.
References
bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-15118
access.redhat.com/errata/RHSA-2018:1104
lists.gnu.org/archive/html/qemu-devel/2017-11/msg05045.html
usn.ubuntu.com/3575-1
securityfocus.com/bid/101975
openwall.com/lists/oss-security/2017/11/28/8
Show 194 moreShow less
exploit-db.com/exploits/43194
nvd.nist.gov/vuln/detail/CVE-2017-15118
github.com/advisories/GHSA-p8q8-xqgv-rwvr
docs.bell-sw.com/security/cves/CVE-2017-15118
security-tracker.debian.org/tracker/CVE-2017-15118
security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_1104.json
cve.org/CVERecord?id=CVE-2017-13672
suse.com/security/cve/CVE-2014-0222
Left out here: 103 references. The JSON record has them.