{"id":"CVE-2018-19364","aliases":["BELL-CVE-2018-19364","DEBIAN-CVE-2018-19364","DLA-1646-1","DSA-4454-1","EUVD-2018-11057","GHSA-6p82-v9w6-85gx","SUSE-SU-2019:0423-1","SUSE-SU-2019:0435-1","SUSE-SU-2019:0457-1","SUSE-SU-2019:0471-1","SUSE-SU-2019:0471-2","SUSE-SU-2019:0489-1","SUSE-SU-2019:0582-1","SUSE-SU-2019:13962-1","UBUNTU-CVE-2018-19364","USN-3826-1","openSUSE-SU-2019:0254-1"],"status":"published","title":"hw/9pfs/cofile.c and hw/9pfs/9p.c in QEMU can modify an fid path while it is being accessed by a...","description":"hw/9pfs/cofile.c and hw/9pfs/9p.c in QEMU can modify an fid path while it is being accessed by a second thread, leading to (for example) a use-after-free outcome.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.0053,"percentile":0.45087,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2018-11-20T00:00:00Z","modified":"2026-10-24T10:30:16Z","fixes":[{"ecosystem":"Debian:12","package":"qemu","fixed_in":["1:3.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"qemu","fixed_in":["1:3.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"qemu","fixed_in":["1:3.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"qemu","fixed_in":["2.0.0+dfsg-2ubuntu1.44"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"qemu","fixed_in":["1:2.5+dfsg-5ubuntu10.33"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"qemu","fixed_in":["1:2.11+dfsg-1ubuntu7.8"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.1+dfsg-12+deb8u9"}]}],"versions":["1:2.1+dfsg-11","1:2.1+dfsg-12","1:2.1+dfsg-12+deb8u1","1:2.1+dfsg-12+deb8u2","1:2.1+dfsg-12+deb8u3","1:2.1+dfsg-12+deb8u4","1:2.1+dfsg-12+deb8u4~bpo70+1","1:2.1+dfsg-12+deb8u5","1:2.1+dfsg-12+deb8u5a","1:2.1+dfsg-12+deb8u5a~bpo70+1","1:2.1+dfsg-12+deb8u6","1:2.1+dfsg-12+deb8u7","1:2.1+dfsg-12+deb8u8","1:2.1+dfsg-12~bpo70+1"],"bundled":3},{"source":"osv","ecosystem":"Debian:9","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.8+dfsg-6+deb9u6"}]}],"versions":["1:2.8+dfsg-6","1:2.8+dfsg-6+deb9u1","1:2.8+dfsg-6+deb9u2","1:2.8+dfsg-6+deb9u3","1:2.8+dfsg-6+deb9u4","1:2.8+dfsg-6+deb9u5"],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.2-9.20.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.2-9.20.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP4","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.2-5.8.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.2-5.8.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.11.2-5.8.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.2-48.49.3"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-33.20.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-33.20.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-41.49.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-41.49.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-41.49.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-41.49.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-41.49.1"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-6.28.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-6.28.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.1-6.28.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 11 SP4","package":"kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-60.21.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 11 SP4","package":"kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.2-60.21.1"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0+dfsg-2ubuntu1.44"}]}],"versions":["1.5.0+dfsg-3ubuntu5","1.5.0+dfsg-3ubuntu6","1.6.0+dfsg-2ubuntu1","1.6.0+dfsg-2ubuntu2","1.6.0+dfsg-2ubuntu3","1.6.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu1","1.7.0+dfsg-2ubuntu2","1.7.0+dfsg-2ubuntu3","1.7.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu5","1.7.0+dfsg-2ubuntu7","1.7.0+dfsg-2ubuntu8","1.7.0+dfsg-2ubuntu9","1.7.0+dfsg-3ubuntu1~ppa1","1.7.0+dfsg-3ubuntu1","1.7.0+dfsg-3ubuntu2","1.7.0+dfsg-3ubuntu3","1.7.0+dfsg-3ubuntu4","1.7.0+dfsg-3ubuntu5","1.7.0+dfsg-3ubuntu6","1.7.0+dfsg-3ubuntu7","2.0.0~rc1+dfsg-0ubuntu1","2.0.0~rc1+dfsg-0ubuntu2","2.0.0~rc1+dfsg-0ubuntu3","2.0.0~rc1+dfsg-0ubuntu3.1","2.0.0+dfsg-2ubuntu1","2.0.0+dfsg-2ubuntu1.1","2.0.0+dfsg-2ubuntu1.2","2.0.0+dfsg-2ubuntu1.3","2.0.0+dfsg-2ubuntu1.5","2.0.0+dfsg-2ubuntu1.6","2.0.0+dfsg-2ubuntu1.7","2.0.0+dfsg-2ubuntu1.8","2.0.0+dfsg-2ubuntu1.9","2.0.0+dfsg-2ubuntu1.10","2.0.0+dfsg-2ubuntu1.11","2.0.0+dfsg-2ubuntu1.13","2.0.0+dfsg-2ubuntu1.14","2.0.0+dfsg-2ubuntu1.15","2.0.0+dfsg-2ubuntu1.16","2.0.0+dfsg-2ubuntu1.17","2.0.0+dfsg-2ubuntu1.18","2.0.0+dfsg-2ubuntu1.19","2.0.0+dfsg-2ubuntu1.20","2.0.0+dfsg-2ubuntu1.21","2.0.0+dfsg-2ubuntu1.22","2.0.0+dfsg-2ubuntu1.24","2.0.0+dfsg-2ubuntu1.25","2.0.0+dfsg-2ubuntu1.26","2.0.0+dfsg-2ubuntu1.27","2.0.0+dfsg-2ubuntu1.28","2.0.0+dfsg-2ubuntu1.29","2.0.0+dfsg-2ubuntu1.30","2.0.0+dfsg-2ubuntu1.31","2.0.0+dfsg-2ubuntu1.32","2.0.0+dfsg-2ubuntu1.33","2.0.0+dfsg-2ubuntu1.34","2.0.0+dfsg-2ubuntu1.35","2.0.0+dfsg-2ubuntu1.36","2.0.0+dfsg-2ubuntu1.38","2.0.0+dfsg-2ubuntu1.39","2.0.0+dfsg-2ubuntu1.40","2.0.0+dfsg-2ubuntu1.41","2.0.0+dfsg-2ubuntu1.42","2.0.0+dfsg-2ubuntu1.43"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.5+dfsg-5ubuntu10.33"}]}],"versions":["1:2.3+dfsg-5ubuntu9","1:2.3+dfsg-5ubuntu10","1:2.4+dfsg-4ubuntu1","1:2.4+dfsg-4ubuntu2","1:2.4+dfsg-4ubuntu3","1:2.4+dfsg-5ubuntu3","1:2.5+dfsg-1ubuntu2","1:2.5+dfsg-1ubuntu3","1:2.5+dfsg-1ubuntu4","1:2.5+dfsg-1ubuntu5","1:2.5+dfsg-5ubuntu1","1:2.5+dfsg-5ubuntu2","1:2.5+dfsg-5ubuntu4","1:2.5+dfsg-5ubuntu6","1:2.5+dfsg-5ubuntu7","1:2.5+dfsg-5ubuntu10","1:2.5+dfsg-5ubuntu10.1","1:2.5+dfsg-5ubuntu10.2","1:2.5+dfsg-5ubuntu10.3","1:2.5+dfsg-5ubuntu10.4","1:2.5+dfsg-5ubuntu10.5","1:2.5+dfsg-5ubuntu10.6","1:2.5+dfsg-5ubuntu10.7","1:2.5+dfsg-5ubuntu10.8","1:2.5+dfsg-5ubuntu10.9","1:2.5+dfsg-5ubuntu10.10","1:2.5+dfsg-5ubuntu10.11","1:2.5+dfsg-5ubuntu10.13","1:2.5+dfsg-5ubuntu10.14","1:2.5+dfsg-5ubuntu10.15","1:2.5+dfsg-5ubuntu10.16","1:2.5+dfsg-5ubuntu10.20","1:2.5+dfsg-5ubuntu10.21","1:2.5+dfsg-5ubuntu10.22","1:2.5+dfsg-5ubuntu10.24","1:2.5+dfsg-5ubuntu10.25","1:2.5+dfsg-5ubuntu10.26","1:2.5+dfsg-5ubuntu10.28","1:2.5+dfsg-5ubuntu10.29","1:2.5+dfsg-5ubuntu10.30","1:2.5+dfsg-5ubuntu10.31","1:2.5+dfsg-5ubuntu10.32"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.11+dfsg-1ubuntu7.8"}]}],"versions":["1:2.10+dfsg-0ubuntu3","1:2.10+dfsg-0ubuntu4","1:2.10+dfsg-0ubuntu5","1:2.11+dfsg-1ubuntu1","1:2.11+dfsg-1ubuntu2","1:2.11+dfsg-1ubuntu4","1:2.11+dfsg-1ubuntu5","1:2.11+dfsg-1ubuntu6","1:2.11+dfsg-1ubuntu7","1:2.11+dfsg-1ubuntu7.1","1:2.11+dfsg-1ubuntu7.2","1:2.11+dfsg-1ubuntu7.3","1:2.11+dfsg-1ubuntu7.4","1:2.11+dfsg-1ubuntu7.5","1:2.11+dfsg-1ubuntu7.6","1:2.11+dfsg-1ubuntu7.7"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0+dfsg-2ubuntu1.44"}]}],"versions":["1.5.0+dfsg-3ubuntu5","1.5.0+dfsg-3ubuntu6","1.6.0+dfsg-2ubuntu1","1.6.0+dfsg-2ubuntu2","1.6.0+dfsg-2ubuntu3","1.6.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu1","1.7.0+dfsg-2ubuntu2","1.7.0+dfsg-2ubuntu3","1.7.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu5","1.7.0+dfsg-2ubuntu7","1.7.0+dfsg-2ubuntu8","1.7.0+dfsg-2ubuntu9","1.7.0+dfsg-3ubuntu1~ppa1","1.7.0+dfsg-3ubuntu1","1.7.0+dfsg-3ubuntu2","1.7.0+dfsg-3ubuntu3","1.7.0+dfsg-3ubuntu4","1.7.0+dfsg-3ubuntu5","1.7.0+dfsg-3ubuntu6","1.7.0+dfsg-3ubuntu7","2.0.0~rc1+dfsg-0ubuntu1","2.0.0~rc1+dfsg-0ubuntu2","2.0.0~rc1+dfsg-0ubuntu3","2.0.0~rc1+dfsg-0ubuntu3.1","2.0.0+dfsg-2ubuntu1","2.0.0+dfsg-2ubuntu1.1","2.0.0+dfsg-2ubuntu1.2","2.0.0+dfsg-2ubuntu1.3","2.0.0+dfsg-2ubuntu1.5","2.0.0+dfsg-2ubuntu1.6","2.0.0+dfsg-2ubuntu1.7","2.0.0+dfsg-2ubuntu1.8","2.0.0+dfsg-2ubuntu1.9","2.0.0+dfsg-2ubuntu1.10","2.0.0+dfsg-2ubuntu1.11","2.0.0+dfsg-2ubuntu1.13","2.0.0+dfsg-2ubuntu1.14","2.0.0+dfsg-2ubuntu1.15","2.0.0+dfsg-2ubuntu1.16","2.0.0+dfsg-2ubuntu1.17","2.0.0+dfsg-2ubuntu1.18","2.0.0+dfsg-2ubuntu1.19","2.0.0+dfsg-2ubuntu1.20","2.0.0+dfsg-2ubuntu1.21","2.0.0+dfsg-2ubuntu1.22","2.0.0+dfsg-2ubuntu1.24","2.0.0+dfsg-2ubuntu1.25","2.0.0+dfsg-2ubuntu1.26","2.0.0+dfsg-2ubuntu1.27","2.0.0+dfsg-2ubuntu1.28","2.0.0+dfsg-2ubuntu1.29","2.0.0+dfsg-2ubuntu1.30","2.0.0+dfsg-2ubuntu1.31","2.0.0+dfsg-2ubuntu1.32","2.0.0+dfsg-2ubuntu1.33","2.0.0+dfsg-2ubuntu1.34","2.0.0+dfsg-2ubuntu1.35","2.0.0+dfsg-2ubuntu1.36","2.0.0+dfsg-2ubuntu1.38","2.0.0+dfsg-2ubuntu1.39","2.0.0+dfsg-2ubuntu1.40","2.0.0+dfsg-2ubuntu1.41","2.0.0+dfsg-2ubuntu1.42","2.0.0+dfsg-2ubuntu1.43"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.5+dfsg-5ubuntu10.33"}]}],"versions":["1:2.3+dfsg-5ubuntu9","1:2.3+dfsg-5ubuntu10","1:2.4+dfsg-4ubuntu1","1:2.4+dfsg-4ubuntu2","1:2.4+dfsg-4ubuntu3","1:2.4+dfsg-5ubuntu3","1:2.5+dfsg-1ubuntu2","1:2.5+dfsg-1ubuntu3","1:2.5+dfsg-1ubuntu4","1:2.5+dfsg-1ubuntu5","1:2.5+dfsg-5ubuntu1","1:2.5+dfsg-5ubuntu2","1:2.5+dfsg-5ubuntu4","1:2.5+dfsg-5ubuntu6","1:2.5+dfsg-5ubuntu7","1:2.5+dfsg-5ubuntu10","1:2.5+dfsg-5ubuntu10.1","1:2.5+dfsg-5ubuntu10.2","1:2.5+dfsg-5ubuntu10.3","1:2.5+dfsg-5ubuntu10.4","1:2.5+dfsg-5ubuntu10.5","1:2.5+dfsg-5ubuntu10.6","1:2.5+dfsg-5ubuntu10.7","1:2.5+dfsg-5ubuntu10.8","1:2.5+dfsg-5ubuntu10.9","1:2.5+dfsg-5ubuntu10.10","1:2.5+dfsg-5ubuntu10.11","1:2.5+dfsg-5ubuntu10.13","1:2.5+dfsg-5ubuntu10.14","1:2.5+dfsg-5ubuntu10.15","1:2.5+dfsg-5ubuntu10.16","1:2.5+dfsg-5ubuntu10.20","1:2.5+dfsg-5ubuntu10.21","1:2.5+dfsg-5ubuntu10.22","1:2.5+dfsg-5ubuntu10.24","1:2.5+dfsg-5ubuntu10.25","1:2.5+dfsg-5ubuntu10.26","1:2.5+dfsg-5ubuntu10.28","1:2.5+dfsg-5ubuntu10.29","1:2.5+dfsg-5ubuntu10.30","1:2.5+dfsg-5ubuntu10.31","1:2.5+dfsg-5ubuntu10.32"],"bundled":10},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.11+dfsg-1ubuntu7.8"}]}],"versions":["1:2.10+dfsg-0ubuntu3","1:2.10+dfsg-0ubuntu4","1:2.10+dfsg-0ubuntu5","1:2.11+dfsg-1ubuntu1","1:2.11+dfsg-1ubuntu2","1:2.11+dfsg-1ubuntu4","1:2.11+dfsg-1ubuntu5","1:2.11+dfsg-1ubuntu6","1:2.11+dfsg-1ubuntu7","1:2.11+dfsg-1ubuntu7.1","1:2.11+dfsg-1ubuntu7.2","1:2.11+dfsg-1ubuntu7.3","1:2.11+dfsg-1ubuntu7.4","1:2.11+dfsg-1ubuntu7.5","1:2.11+dfsg-1ubuntu7.6","1:2.11+dfsg-1ubuntu7.7"],"bundled":10}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"opensuse","product":"leap"},{"vendor":"qemu","product":"qemu"}],"references":[{"url":"https://lists.debian.org/debian-lts-announce/2019/01/msg00023.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.gnu.org/archive/html/qemu-devel/2018-11/msg01139.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Vendor Advisory","fix","report"]},{"url":"https://usn.ubuntu.com/3826-1/","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2018/11/20/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory","fix"]},{"url":"https://lists.gnu.org/archive/html/qemu-devel/2018-11/msg02795.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Vendor Advisory","fix","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CGCFIFSIWUREEQQOZDZFBYKWZHXCWBZN/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-03/msg00042.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2019/dsa-4454","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://seclists.org/bugtraq/2019/May/76","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-19364"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CGCFIFSIWUREEQQOZDZFBYKWZHXCWBZN/"},{"url":"https://github.com/advisories/GHSA-6p82-v9w6-85gx"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2018-19364","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-19364","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190423-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1063993","tags":["report"]},{"url":"https://bugzilla.suse.com/1079730","tags":["report"]},{"url":"https://bugzilla.suse.com/1100408","tags":["report"]},{"url":"https://bugzilla.suse.com/1101982","tags":["report"]},{"url":"https://bugzilla.suse.com/1112646","tags":["report"]},{"url":"https://bugzilla.suse.com/1114957","tags":["report"]},{"url":"https://bugzilla.suse.com/1116717","tags":["report"]},{"url":"https://bugzilla.suse.com/1117275","tags":["report"]},{"url":"https://bugzilla.suse.com/1119493","tags":["report"]},{"url":"https://bugzilla.suse.com/1121600","tags":["report"]},{"url":"https://bugzilla.suse.com/1123156","tags":["report"]},{"url":"https://bugzilla.suse.com/1123179","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16872","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-18954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19364","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-19489","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-6778","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190435-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190457-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190471-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190471-2/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190489-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1084604","tags":["report"]},{"url":"https://bugzilla.suse.com/1113231","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13672","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-13673","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-7858","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20190582-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1056334","tags":["report"]},{"url":"https://bugzilla.suse.com/1056386","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-201913962-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1109544","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-19364","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2018/11/20/1","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3826-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-19364","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-10839","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-11806","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-12617","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-16847","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-17958","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-17962","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-17963","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-18849","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2018-18954","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/CFHQEGEI3EZECFQN4HM6ST73KWNYQDTG/#CFHQEGEI3EZECFQN4HM6ST73KWNYQDTG","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2018-19364","description":"hw/9pfs/cofile.c and hw/9pfs/9p.c in QEMU can modify an fid path while it is being accessed by a second thread, leading to (for example) a use-after-free outcome.","status":"published","published":"2018-12-13T19:00:00Z","modified":"2024-08-05T11:37:10.59Z","updated_at":"2026-11-02T14:35:02.966615Z"}],"euvd":[{"id":"EUVD-2018-11057","description":"hw/9pfs/cofile.c and hw/9pfs/9p.c in QEMU can modify an fid path while it is being accessed by a second thread, leading to (for example) a use-after-free outcome.","status":"published","published":"2018-12-13T19:00:00Z","modified":"2024-08-05T11:37:10Z","updated_at":"2026-11-03T02:39:33.782065Z"}],"ghsa":[{"id":"GHSA-6p82-v9w6-85gx","title":"hw/9pfs/cofile.c and hw/9pfs/9p.c in QEMU can modify an fid path while it is being accessed by a...","description":"hw/9pfs/cofile.c and hw/9pfs/9p.c in QEMU can modify an fid path while it is being accessed by a second thread, leading to (for example) a use-after-free outcome.","status":"published","published":"2022-05-13T01:26:37Z","modified":"2023-02-01T05:07:33Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:50:33.423478Z"}],"nvd":[{"id":"CVE-2018-19364","description":"hw/9pfs/cofile.c and hw/9pfs/9p.c in QEMU can modify an fid path while it is being accessed by a second thread, leading to (for example) a use-after-free outcome.","status":"published","published":"2018-12-13T19:29:00.497Z","modified":"2026-06-17T01:49:12.91Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:N/I:N/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:04:50.99633Z"}],"osv":[{"id":"BELL-CVE-2018-19364","title":"CVE-2018-19364 does not affect BellSoft software","status":"withdrawn","published":"2018-12-13T19:29:00Z","modified":"2026-01-26T09:48:33.38991Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:14.701973Z"},{"id":"CVE-2018-19364","description":"hw/9pfs/cofile.c and hw/9pfs/9p.c in QEMU can modify an fid path while it is being accessed by a second thread, leading to (for example) a use-after-free outcome.","status":"published","published":"2018-12-13T19:29:00.497Z","modified":"2026-10-24T10:30:16.968922377Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:08.834469Z"},{"id":"DEBIAN-CVE-2018-19364","description":"hw/9pfs/cofile.c and hw/9pfs/9p.c in QEMU can modify an fid path while it is being accessed by a second thread, leading to (for example) a use-after-free outcome.","status":"published","published":"2018-12-13T19:29:00.497Z","modified":"2026-10-23T18:01:42.186346766Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:30.57382Z"},{"id":"UBUNTU-CVE-2018-19364","description":"hw/9pfs/cofile.c and hw/9pfs/9p.c in QEMU can modify an fid path while it is being accessed by a second thread, leading to (for example) a use-after-free outcome.","status":"published","published":"2018-11-20T00:00:00Z","modified":"2026-02-04T04:04:15.267167Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"},{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:54:17.496046Z"},{"id":"DLA-1646-1","title":"qemu - security update","status":"published","published":"2019-01-29T00:00:00Z","modified":"2026-03-09T01:18:30.478828Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"DSA-4454-1","title":"qemu - security update","status":"published","published":"2019-05-30T00:00:00Z","modified":"2026-03-09T02:10:53.225814Z","updated_at":"2026-11-02T15:46:16.862196Z"},{"id":"openSUSE-SU-2019:0254-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-6778: Fixed a heap buffer overflow issue in the SLiRP networking implementation (bsc#1123156).\n- CVE-2018-16872: Fixed a host security vulnerability related to handling symlinks in usb-mtp (bsc#1119493).\n- CVE-2018-19489: Fixed a denial of service vulnerability in virtfs (bsc#1117275).\n- CVE-2018-19364: Fixed a use-after-free if the virtfs interface resulting in a denial of service (bsc#1116717).\n- CVE-2018-18954: Fixed a denial of service vulnerability related to PowerPC PowerNV memory operations (bsc#1114957).\n\nNon-security issues fixed:\n\n- Improved disk performance for qemu on xen (bsc#1100408).\n- Fixed xen offline migration (bsc#1079730, bsc#1101982, bsc#1063993).\n- Fixed pwrite64/pread64/write to return 0 over -1 for a zero length NULL buffer in qemu (bsc#1121600).\n- Use /bin/bash to echo value into sys fs for ksm control (bsc#1112646).\n- Return specification exception for unimplemented diag 308 subcodes rather than a hardware error (bsc#1123179).\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2019-03-23T11:07:37Z","modified":"2026-02-04T03:39:38.502397Z","updated_at":"2026-11-02T16:58:30.39372Z"},{"id":"SUSE-SU-2019:0423-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-6778: Fixed a heap buffer overflow issue in the SLiRP networking implementation (bsc#1123156).\n- CVE-2018-16872: Fixed a host security vulnerability related to handling symlinks in usb-mtp (bsc#1119493).\n- CVE-2018-19489: Fixed a denial of service vulnerability in virtfs (bsc#1117275).\n- CVE-2018-19364: Fixed a use-after-free if the virtfs interface resulting in a denial of service (bsc#1116717).\n- CVE-2018-18954: Fixed a denial of service vulnerability related to PowerPC PowerNV memory operations (bsc#1114957).\n\nNon-security issues fixed:\n\n- Improved disk performance for qemu on xen (bsc#1100408).\n- Fixed xen offline migration (bsc#1079730, bsc#1101982, bsc#1063993).\n- Fixed pwrite64/pread64/write to return 0 over -1 for a zero length NULL buffer in qemu (bsc#1121600).\n- Use /bin/bash to echo value into sys fs for ksm control (bsc#1112646).\n- Return specification exception for unimplemented diag 308 subcodes rather than a hardware error (bsc#1123179).\n","status":"published","published":"2019-02-18T15:26:50Z","modified":"2026-02-04T04:22:58.164555Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0435-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-6778: Fixed a heap buffer overflow issue in the SLiRP networking implementation (bsc#1123156).\n- CVE-2018-16872: Fixed a host security vulnerability related to handling symlinks in usb-mtp (bsc#1119493).\n- CVE-2018-19489: Fixed a denial of service vulnerability in virtfs (bsc#1117275).\n- CVE-2018-19364: Fixed a use-after-free if the virtfs interface resulting in a denial of service (bsc#1116717).\n- CVE-2018-18954: Fixed a denial of service vulnerability related to PowerPC PowerNV memory operations (bsc#1114957).\n\nNon-security issues fixed:\n\n- Improved disk performance for qemu on xen (bsc#1100408).\n- Fixed xen offline migration (bsc#1079730, bsc#1101982, bsc#1063993).\n- Fixed pwrite64/pread64/write to return 0 over -1 for a zero length NULL buffer in qemu (bsc#1121600).\n- Use /bin/bash to echo value into sys fs for ksm control (bsc#1112646).\n- Return specification exception for unimplemented diag 308 subcodes rather than a hardware error (bsc#1123179).\n","status":"published","published":"2019-02-19T12:12:38Z","modified":"2026-02-04T02:22:49.786112Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0457-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-6778: Fixed a heap buffer overflow issue in the SLiRP networking implementation (bsc#1123156).\n- CVE-2018-19489: Fixed a denial of service vulnerability in virtfs (bsc#1117275).\n* CVE-2018-19364: Fixed a use-after-free if the virtfs interface resulting in a denial of service (bsc#1116717).\n","status":"published","published":"2019-02-21T06:07:42Z","modified":"2026-02-04T04:27:54.624216Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0471-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-6778: Fixed a heap buffer overflow issue in the SLiRP networking implementation (bsc#1123156).\n- CVE-2018-16872: Fixed a host security vulnerability related to handling symlinks in usb-mtp (bsc#1119493).\n- CVE-2018-19489: Fixed a denial of service vulnerability in virtfs (bsc#1117275).\n- CVE-2018-19364: Fixed a use-after-free if the virtfs interface resulting in a denial of service (bsc#1116717).\n","status":"published","published":"2019-02-22T12:47:28Z","modified":"2026-02-04T04:36:52.806007Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0471-2","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\nSecurity issue fixed:\n\n- CVE-2019-6778: Fixed a heap buffer overflow issue in the SLiRP networking implementation (bsc#1123156).\n- CVE-2018-16872: Fixed a host security vulnerability related to handling symlinks in usb-mtp (bsc#1119493).\n- CVE-2018-19489: Fixed a denial of service vulnerability in virtfs (bsc#1117275).\n- CVE-2018-19364: Fixed a use-after-free if the virtfs interface resulting in a denial of service (bsc#1116717).\n","status":"published","published":"2019-04-27T15:57:03Z","modified":"2026-02-04T04:13:34.437584Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0489-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-6778: Fixed a heap buffer overflow issue in the SLiRP networking implementation (bsc#1123156).\n- CVE-2018-16872: Fixed a host security vulnerability related to handling symlinks in usb-mtp (bsc#1119493).\n- CVE-2018-19489: Fixed a denial of service vulnerability in virtfs (bsc#1117275).\n- CVE-2018-19364: Fixed a use-after-free if the virtfs interface resulting in a denial of service (bsc#1116717).\n- CVE-2018-7858: Fixed a denial of service which could occur while updating the VGA display, after guest has adjusted the display dimensions (bsc#1084604).\n- CVE-2017-13673: Fixed a denial of service in the cpu_physical_memory_snapshot_get_dirty function.\n- CVE-2017-13672: Fixed a denial of service via vectors involving display update.\n\nNon-security issues fixed:\n\n- Fixed bad guest time after migration (bsc#1113231).\n","status":"published","published":"2019-02-26T07:40:31Z","modified":"2026-02-04T03:59:44.996909Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:0582-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\nSecurity vulnerabilities addressed:\n\n- CVE-2019-6778: Fixed an out-of-bounds access in slirp (bsc#1123156)\n- CVE-2018-16872: Fixed a host security vulnerability related to handling symlinks in usb-mtp (bsc#1119493)\n- CVE-2018-19489: Fixed a Denial-of-Service in virtfs (bsc#1117275)\n- CVE-2018-19364: Fixed an use-after-free vulnerability if virtfs interface is deliberately abused (bsc#1116717)\n- CVE-2018-18954: Fixed an out-of-bounds access performing PowerNV memory operations (bsc#1114957)\n- CVE-2017-13673: Fixed a reachable assert failure during during display update (bsc#1056386)\n- CVE-2017-13672: Fixed an out-of-bounds read access during display update (bsc#1056334)\n- CVE-2018-7858: Fixed an out-of-bounds access in cirrus when updating vga display allowing for Denial-of-Service (bsc#1084604)\n\nOther bug fixes and changes:\n\n- Fix pwrite64/pread64/write to return 0 over -1 for a zero length NULL buffer in qemu (bsc#1121600)\n- Fix bad guest time after migration (bsc#1113231)\n","status":"published","published":"2019-03-11T17:34:20Z","modified":"2025-05-02T04:06:23.528007Z","updated_at":"2026-11-02T15:53:45.926331Z"},{"id":"SUSE-SU-2019:13962-1","title":"Security update for kvm","description":"This update for kvm fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2019-6778: Fixed a heap buffer overflow issue in the SLiRP networking implementation (bsc#1123156).\n- CVE-2018-19489: Fixed a denial of service vulnerability in virtfs (bsc#1117275).\n- CVE-2018-19364: Fixed a use-after-free if the virtfs interface resulting in a denial of service (bsc#1116717).\n\nNon-security issue fixed:\n\n- Fixed LAPIC TSC deadline timer save/restore (bsc#1109544)\n","status":"published","published":"2019-02-15T10:43:11Z","modified":"2026-02-04T04:39:05.201406Z","updated_at":"2026-11-02T15:53:46.44301Z"},{"id":"USN-3826-1","title":"qemu vulnerabilities","description":"Daniel Shapira and Arash Tohidi discovered that QEMU incorrectly handled\nNE2000 device emulation. An attacker inside the guest could use this issue\nto cause QEMU to crash, resulting in a denial of service. (CVE-2018-10839)\n\nIt was discovered that QEMU incorrectly handled the Slirp networking\nback-end. A privileged attacker inside the guest could use this issue to\ncause QEMU to crash, resulting in a denial of service, or possibly execute\narbitrary code on the host. In the default installation, when QEMU is used\nwith libvirt, attackers would be isolated by the libvirt AppArmor profile.\nThis issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS and Ubuntu\n18.04 LTS. (CVE-2018-11806)\n\nFakhri Zulkifli discovered that the QEMU guest agent incorrectly handled\ncertain QMP commands. An attacker could possibly use this issue to crash\nthe QEMU guest agent, resulting in a denial of service. (CVE-2018-12617)\n\nLi Qiang discovered that QEMU incorrectly handled NVM Express Controller\nemulation. An attacker inside the guest could use this issue to cause QEMU\nto crash, resulting in a denial of service, or possibly execute arbitrary\ncode on the host. In the default installation, when QEMU is used with\nlibvirt, attackers would be isolated by the libvirt AppArmor profile. This\nissue only affected Ubuntu 18.04 LTS and Ubuntu 18.10. (CVE-2018-16847)\n\nDaniel Shapira and Arash Tohidi discovered that QEMU incorrectly handled\nRTL8139 device emulation. An attacker inside the guest could use this issue\nto cause QEMU to crash, resulting in a denial of service. (CVE-2018-17958)\n\nDaniel Shapira and Arash Tohidi discovered that QEMU incorrectly handled\nPCNET device emulation. An attacker inside the guest could use this issue\nto cause QEMU to crash, resulting in a denial of service. (CVE-2018-17962)\n\nDaniel Shapira discovered that QEMU incorrectly handled large packet sizes.\nAn attacker inside the guest could use this issue to cause QEMU to crash,\nresulting in a denial of service. (CVE-2018-17963)\n\nIt was discovered that QEMU incorrectly handled LSI53C895A device\nemulation. An attacker inside the guest could use this issue to cause QEMU\nto crash, resulting in a denial of service. (CVE-2018-18849)\n\nMoguofang discovered that QEMU incorrectly handled the IPowerNV LPC\ncontroller. An attacker inside the guest could use this issue to cause QEMU\nto crash, resulting in a denial of service. This issue only affected Ubuntu\n18.04 LTS and Ubuntu 18.10. (CVE-2018-18954)\n\nZhibin Hu discovered that QEMU incorrectly handled the Plan 9 File System\nsupport. An attacker inside the guest could use this issue to cause QEMU\nto crash, resulting in a denial of service. (CVE-2018-19364)\n","status":"published","published":"2018-11-26T14:23:51Z","modified":"2026-05-04T09:38:36.737045Z","updated_at":"2026-11-02T16:58:14.019824Z"}]}}