Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2017-5973 Details

Description

The xhci_kick_epctx function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (infinite loop and QEMU process crash) via vectors related to control transfer descriptor sequence.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:5.5 MEDIUMVector:CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
http://git.qemu-project.org/?p=qemu.git%3Ba=commit%3Bh=f89b60f6e5fee3923bedf80e82b4e5efc1bb156b CVE
https://access.redhat.com/errata/RHSA-2017:2392 CVEThird Party Advisory
https://access.redhat.com/errata/RHSA-2017:2408 CVEThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1421626 CVEIssue TrackingPatchThird Party Advisory
https://lists.debian.org/debian-lts-announce/2018/09/msg00007.html CVEThird Party Advisory

see all 18 references

Weakness Enumeration

CWE-IDCWE NameSource
CWE-835Loop with Unreachable Exit Condition ('Infinite Loop')[email protected]

Affected Products

ProductVersions
qemu qemu
<= 2.8.1.1

CPE

  • cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.
debian debian linux
8.0

CPE

  • cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.
redhat openstack
6.0
7.0
8
9
10

CPE

  • cpe:2.3:a:redhat:openstack:6.0:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:openstack:7.0:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:openstack:8:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:openstack:9:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:openstack:10:*:*:*:*:*:*:*
  • cpe:2.3:a:redhat:openstack:11:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.
redhat virtualization
4.0

CPE

  • cpe:2.3:a:redhat:virtualization:4.0:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.
redhat enterprise linux
7.0

CPE

  • cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

15 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2017-5973
NVD Published Date:
Mar 27, 2017
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]