CVE-2017-8284

The disas_insn function in target/i386/translate.c in QEMU before 2.9.0, when TCG mode without hardware acceleration is used, does not limit the instruction size, which allows local users to gain privileges by creating a modified basic block that injects code into a setuid program, as demonstrated by procmail. NOTE: the vendor has stated "this bug does not violate any security guarantees QEMU makes.

References

Affected packages

Git / github.com/qemu/qemu

Affected ranges

Type

GIT

Repo

https://github.com/qemu/qemu

Events

Introduced

Last affected

d1b725ee12539906b72777fde1f6c73c2273d806

Fixed

30663fd26c0307e414622c7a8607fbc04f92ec14

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.8.1.1"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:qemu:qemu:*:*:*:*:*:*:*:*"
}

Affected versions

v0.*

v0.1.0

v0.1.1

v0.1.3

v0.1.4

v0.1.5

v0.1.6

v0.11.0-rc0

v0.12.0-rc0

v0.13.0-rc0

v0.14.0-rc0

v0.2.0

v0.3.0

v0.4.0

v0.4.1

v0.4.2

v0.4.3

v0.4.4

v0.5.0

v1.*

v1.0

v1.0-rc0

v1.0-rc1

v1.0-rc2

v1.0-rc3

v1.0-rc4

v1.1-rc0

v1.1-rc1

v1.1-rc2

v1.1.0

v1.1.0-rc2

v1.1.0-rc3

v1.1.0-rc4

v1.2.0

v1.2.0-rc0

v1.2.0-rc1

v1.2.0-rc2

v1.2.0-rc3

v1.3.0

v1.3.0-rc0

v1.3.0-rc1

v1.3.0-rc2

v1.4.0

v1.4.0-rc0

v1.4.0-rc1

v1.4.0-rc2

v1.5.0

v1.5.0-rc0

v1.5.0-rc1

v1.5.0-rc2

v1.5.0-rc3

v1.6.0

v1.6.0-rc0

v1.6.0-rc1

v1.6.0-rc2

v1.6.0-rc3

v1.7.0

v1.7.0-rc0

v1.7.0-rc1

v1.7.0-rc2

v2.*

v2.0.0

v2.0.0-rc0

v2.0.0-rc1

v2.0.0-rc2

v2.0.0-rc3

v2.1.0

v2.1.0-rc0

v2.1.0-rc1

v2.1.0-rc2

v2.1.0-rc3

v2.1.0-rc4

v2.1.0-rc5

v2.2.0

v2.2.0-rc0

v2.2.0-rc1

v2.2.0-rc2

v2.2.0-rc3

v2.2.0-rc4

v2.2.0-rc5

v2.3.0

v2.3.0-rc0

v2.3.0-rc1

v2.3.0-rc2

v2.3.0-rc3

v2.3.0-rc4

v2.4.0

v2.4.0-rc0

v2.4.0-rc1

v2.4.0-rc2

v2.4.0-rc3

v2.4.0-rc4

v2.5.0

v2.5.0-rc0

v2.5.0-rc1

v2.5.0-rc2

v2.5.0-rc3

v2.5.0-rc4

v2.6.0

v2.6.0-rc0

v2.6.0-rc1

v2.6.0-rc2

v2.6.0-rc3

v2.6.0-rc4

v2.6.0-rc5

v2.7.0

v2.7.0-rc0

v2.7.0-rc1

v2.7.0-rc2

v2.7.0-rc3

v2.7.0-rc4

v2.7.0-rc5

v2.8.0

v2.8.0-rc0

v2.8.0-rc1

v2.8.0-rc2

v2.8.0-rc3

v2.8.0-rc4

v2.8.1

v2.8.1.1

v2.9.0-rc0

v2.9.0-rc1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-8284.json"

vanir_signatures_modified

"2026-07-08T11:36:30Z"

vanir_signatures

[
    {
        "digest": {
            "function_hash": "62858087643175459389038123897881956661",
            "length": 84726.0
        },
        "id": "CVE-2017-8284-44dad5dd",
        "deprecated": false,
        "signature_version": "v1",
        "source": "https://github.com/qemu/qemu/commit/30663fd26c0307e414622c7a8607fbc04f92ec14",
        "signature_type": "Function",
        "target": {
            "function": "disas_insn",
            "file": "target/i386/translate.c"
        }
    },
    {
        "digest": {
            "line_hashes": [
                "6578780634270786687336334246437024637",
                "174909187175943662593529517711432456963",
                "25295187560342897628802647788980434776",
                "321751920125528071603375534809250973200"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2017-8284-691b8e18",
        "deprecated": false,
        "signature_version": "v1",
        "source": "https://github.com/qemu/qemu/commit/30663fd26c0307e414622c7a8607fbc04f92ec14",
        "signature_type": "Line",
        "target": {
            "file": "target/i386/translate.c"
        }
    }
]

Git / gitlab.com/qemu-project/qemu