VULNERABILITY INTELLIGENCE

CVE-2017-15038

CVSS score5.6 MEDIUM
EPSS probability0.28%
CISA KEVNot currently listed
Published2017-10-10
Last modified2026-06-17
CVSS vectorCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N

Description

Race condition in the v9fs_xattrwalk function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS users to obtain sensitive information from host heap memory via vectors related to reading extended attributes.

Weakness classification

  • CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Primary references