CVE-2018-18849

Name of the Vulnerable Software and Affected Versions: QEMU version 3.0.0

Description: The issue is related to the lsi do msgin function in the QEMU hardware emulator, specifically in the hw/scsi/lsi53c895a.c file. It involves a buffer data boundary read issue. Exploitation of this issue could allow an attacker to cause a denial of service due to an invalid value of the msg len variable.

Recommendations: For QEMU version 3.0.0, as a temporary workaround, consider restricting access to the lsi do msgin function in the hw/scsi/lsi53c895a.c file until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.