CVE-2018-12617

Name of the Vulnerable Software and Affected Versions: QEMU versions 2.12.50

Description: The issue is related to an integer overflow in the qmp guest file read function, which can cause a segmentation fault when attempting to allocate a large memory chunk. This can be exploited by sending a crafted QMP command, including guest-file-read with a large count value, to the agent via the listening socket.

Recommendations: For QEMU version 2.12.50, as a temporary workaround, consider restricting access to the qmp guest file read function until a patch is available. Avoid using the guest-file-read command with large count values in the affected QMP command until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.