Every CVE Search/ Get API key

CVE-2017-2630

A stack buffer overflow flaw was found in the Quick Emulator (QEMU) before 2.9 built with the...

5.5 MediumFix available

A stack buffer overflow flaw was found in the Quick Emulator (QEMU) before 2.9 built with the Network Block Device (NBD) client support. The flaw could occur while processing server's response to a 'NBD_OPT_LIST' request. A malicious NBD server could use this issue to crash a remote NBD client resulting in DoS or potentially execute arbitrary code on client host with privileges of the QEMU process.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
High
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
Low

Exploit likelihood

2.65%Up 0.1 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 5.5

A stack buffer overflow flaw was found in the Quick Emulator (QEMU) before 2.9 built with the Network Block Device (NBD) client support. The flaw could occur while processing server's response to a 'NBD_OPT_LIST' request. A malicious NBD server could use this issue to crash a remote NBD client resulting in DoS or potentially execute arbitrary code on client host with privileges of the QEMU process.

Record
CVE-2017-2630
CVSS 3.0
5.5 MediumCVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L
Weakness
CWE-121
Updated
2026-11-02
EUVDEUVD-2017-11791 5.5

A stack buffer overflow flaw was found in the Quick Emulator (QEMU) before 2.9 built with the Network Block Device (NBD) client support. The flaw could occur while processing server's response to a 'NBD_OPT_LIST' request. A malicious NBD server could use this issue to crash a remote NBD client resulting in DoS or potentially execute arbitrary code on client host with privileges of the QEMU process.

Record
EUVD-2017-11791
CVSS 3.0
5.5 MediumCVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-03
GitHub AdvisoriesGHSA-2rf9-cmpf-qww5 8.8

A stack buffer overflow flaw was found in the Quick Emulator (QEMU) before 2.9 built with the...

A stack buffer overflow flaw was found in the Quick Emulator (QEMU) before 2.9 built with the Network Block Device (NBD) client support. The flaw could occur while processing server's response to a 'NBD_OPT_LIST' request. A malicious NBD server could use this issue to crash a remote NBD client resulting in DoS or potentially execute arbitrary code on client host with privileges of the QEMU process.

Record
GHSA-2rf9-cmpf-qww5
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-121
Updated
2026-11-02
NVD 5.5

A stack buffer overflow flaw was found in the Quick Emulator (QEMU) before 2.9 built with the Network Block Device (NBD) client support. The flaw could occur while processing server's response to a 'NBD_OPT_LIST' request. A malicious NBD server could use this issue to crash a remote NBD client resulting in DoS or potentially execute arbitrary code on client host with privileges of the QEMU process.

Record
CVE-2017-2630
CVSS 3.0
5.5 MediumCVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
6.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:P
Weakness
CWE-121, CWE-119
Updated
2026-11-02
OSVBELL-CVE-2017-2630 8.8

CVE-2017-2630 does not affect BellSoft software

Record
BELL-CVE-2017-2630
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 8.8

A stack buffer overflow flaw was found in the Quick Emulator (QEMU) before 2.9 built with the Network Block Device (NBD) client support. The flaw could occur while processing server's response to a 'NBD_OPT_LIST' request. A malicious NBD server could use this issue to crash a remote NBD client resulting in DoS or potentially execute arbitrary code on client host with privileges of the QEMU process.

Record
CVE-2017-2630
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2017-2630 8.8

A stack buffer overflow flaw was found in the Quick Emulator (QEMU) before 2.9 built with the Network Block Device (NBD) client support. The flaw could occur while processing server's response to a 'NBD_OPT_LIST' request. A malicious NBD server could use this issue to crash a remote NBD client resulting in DoS or potentially execute arbitrary code on client host with privileges of the QEMU process.

Record
DEBIAN-CVE-2017-2630
CVSS 3.0
8.8 HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2017:2392 5.5

Red Hat Security Advisory: qemu-kvm-rhev security, bug fix, and enhancement update

Record
RHSA-2017:2392
CVSS 3.0
5.5 MediumCVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L
Updated
2026-11-02
OSVopenSUSE-SU-2024:11287-1 No score

qemu-6.1.0-32.1 on GA media

These are all security issues fixed in the qemu-6.1.0-32.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:11287-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
qemu
Debian:12
 before 1:2.8+dfsg-3
1:2.8+dfsg-3
qemu
Debian:13
 before 1:2.8+dfsg-3
1:2.8+dfsg-3
qemu
Debian:14
 before 1:2.8+dfsg-3
1:2.8+dfsg-3
qemu-img-rhev
Red Hat:enterprise_linux:7::hypervisor
From an advisory covering 22 CVEs
 before 10:2.9.0-14.el7
10:2.9.0-14.el7
qemu-kvm-common-rhev
Red Hat:enterprise_linux:7::hypervisor
From an advisory covering 22 CVEs
 before 10:2.9.0-14.el7
10:2.9.0-14.el7
qemu-kvm-rhev
Red Hat:enterprise_linux:7::hypervisor
From an advisory covering 22 CVEs
 before 10:2.9.0-14.el7
10:2.9.0-14.el7
qemu-kvm-rhev-debuginfo
Red Hat:enterprise_linux:7::hypervisor
From an advisory covering 22 CVEs
 before 10:2.9.0-14.el7
10:2.9.0-14.el7
qemu-kvm-tools-rhev
Red Hat:enterprise_linux:7::hypervisor
From an advisory covering 22 CVEs
 before 10:2.9.0-14.el7
10:2.9.0-14.el7
qemu
openSUSE:Tumbleweed
From an advisory covering 135 CVEs
 before 6.1.0-32.1
6.1.0-32.1

History

History
RecordedChangedSources
affected, facts
aliases, productsEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-2630 is a medium vulnerability (CVSS 5.5) in Qemu, published July 27, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.65%, the 85th percentile. Fixed in qemu 1:2.8+dfsg-3.

References

Show 194 moreShow less
This page doesn't list everything

Left out here: 239 references. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open