CVE-2014-0148

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

Qemu before 2.0 block driver for Hyper-V VHDX Images is vulnerable to infinite loops and other potential issues when calculating BAT entries, due to missing bounds checks for block_size and logical_sector_size variables. These are used to derive other fields like 'sectors_per_block' etc. A user able to alter the Qemu disk image could ise this flaw to crash the Qemu instance resulting in DoS.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-835

Affected software

Vendor	Product	Versions
n/a	Qemu	before 2.0

References

http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=1d7678dec4761acdc43439da6ceda41a703ba1a6
http://rhn.redhat.com/errata/RHSA-2014-0420.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2014-0421.htmlThird Party Advisory
http://www.openwall.com/lists/oss-security/2014/03/26/8Mailing List, Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1078212Issue Tracking, Patch, Third Party Advisory
https://lists.gnu.org/archive/html/qemu-devel/2014-03/msg04994.htmlMailing List, Patch, Third Party Advisory
http://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=1d7678dec4761acdc43439da6ceda41a703ba1a6
http://rhn.redhat.com/errata/RHSA-2014-0420.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2014-0421.htmlThird Party Advisory
http://www.openwall.com/lists/oss-security/2014/03/26/8Mailing List, Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1078212Issue Tracking, Patch, Third Party Advisory
https://lists.gnu.org/archive/html/qemu-devel/2014-03/msg04994.htmlMailing List, Patch, Third Party Advisory

Timeline

Published: Sep 29, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-01494.3Multiple cross-site scripting (XSS) vulnerabilities in Red Hat JBoss Web Framework Kit 2.5.0 allow remote attackers to inject arbitrary web CVE-2014-01504.9Integer overflow in the virtio_net_handle_mac function in hw/net/virtio-net.c in QEMU 2.0 and earlier allows local guest users to execute ar CVE-2014-01516.8Cross-site request forgery (CSRF) vulnerability in oVirt Engine before 3.5.0 beta2 allows remote attackers to hijack the authentication of u CVE-2014-01526.8Session fixation vulnerability in the web admin interface in oVirt 3.4.0 and earlier allows remote attackers to hijack web sessions via unsp CVE-2014-01534.3The REST API in oVirt 3.4.0 and earlier stores session IDs in HTML5 local storage, which allows remote attackers to obtain sensitive informa CVE-2014-01545.0oVirt Engine before 3.5.0 does not include the HTTPOnly flag in a Set-Cookie header for the session IDs, which makes it easier for remote at CVE-2014-01555.5The ioapic_deliver function in virt/kvm/ioapic.c in the Linux kernel through 3.14.1 does not properly validate the kvm_irq_delivery_to_apic CVE-2014-01569.8Awesome spawn contains OS command injection vulnerability, which allows execution of additional commands passed to Awesome spawn as argument CVE-2014-01574.3Cross-site scripting (XSS) vulnerability in the Horizon Orchestration dashboard in OpenStack Dashboard (aka Horizon) 2013.2 before 2013.2.4 CVE-2014-01588.8Heap-based buffer overflow in the JPEG2000 image tile decoder in OpenJPEG before 1.5.2 allows remote attackers to cause a denial of service CVE-2014-01595.0Buffer overflow in the GetStatistics64 remote procedure call (RPC) in OpenAFS 1.4.8 before 1.6.7 allows remote attackers to cause a denial o CVE-2014-01607.5The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows rem