{"id":"CVE-2017-8284","details":"The disas_insn function in target/i386/translate.c in QEMU before 2.9.0, when TCG mode without hardware acceleration is used, does not limit the instruction size, which allows local users to gain privileges by creating a modified basic block that injects code into a setuid program, as demonstrated by procmail. NOTE: the vendor has stated \"this bug does not violate any security guarantees QEMU makes.","modified":"2026-04-11T04:59:31.671671Z","published":"2017-04-26T14:59:00.270Z","references":[{"type":"REPORT","url":"https://bugs.chromium.org/p/project-zero/issues/detail?id=1122"},{"type":"FIX","url":"https://github.com/qemu/qemu/commit/30663fd26c0307e414622c7a8607fbc04f92ec14"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/qemu/qemu","events":[{"introduced":"0"},{"last_affected":"d1b725ee12539906b72777fde1f6c73c2273d806"},{"fixed":"30663fd26c0307e414622c7a8607fbc04f92ec14"}],"database_specific":{"versions":[{"introduced":"0"},{"last_affected":"2.8.1.1"}]}}],"versions":["v0.1.0","v0.1.1","v0.1.3","v0.1.4","v0.1.5","v0.1.6","v0.11.0-rc0","v0.12.0-rc0","v0.13.0-rc0","v0.14.0-rc0","v0.2.0","v0.3.0","v0.4.0","v0.4.1","v0.4.2","v0.4.3","v0.4.4","v0.5.0","v1.0","v1.0-rc0","v1.0-rc1","v1.0-rc2","v1.0-rc3","v1.0-rc4","v1.1-rc0","v1.1-rc1","v1.1-rc2","v1.1.0","v1.1.0-rc2","v1.1.0-rc3","v1.1.0-rc4","v1.2.0","v1.2.0-rc0","v1.2.0-rc1","v1.2.0-rc2","v1.2.0-rc3","v1.3.0","v1.3.0-rc0","v1.3.0-rc1","v1.3.0-rc2","v1.4.0","v1.4.0-rc0","v1.4.0-rc1","v1.4.0-rc2","v1.5.0","v1.5.0-rc0","v1.5.0-rc1","v1.5.0-rc2","v1.5.0-rc3","v1.6.0","v1.6.0-rc0","v1.6.0-rc1","v1.6.0-rc2","v1.6.0-rc3","v1.7.0","v1.7.0-rc0","v1.7.0-rc1","v1.7.0-rc2","v2.0.0","v2.0.0-rc0","v2.0.0-rc1","v2.0.0-rc2","v2.0.0-rc3","v2.1.0","v2.1.0-rc0","v2.1.0-rc1","v2.1.0-rc2","v2.1.0-rc3","v2.1.0-rc4","v2.1.0-rc5","v2.2.0","v2.2.0-rc0","v2.2.0-rc1","v2.2.0-rc2","v2.2.0-rc3","v2.2.0-rc4","v2.2.0-rc5","v2.3.0","v2.3.0-rc0","v2.3.0-rc1","v2.3.0-rc2","v2.3.0-rc3","v2.3.0-rc4","v2.4.0","v2.4.0-rc0","v2.4.0-rc1","v2.4.0-rc2","v2.4.0-rc3","v2.4.0-rc4","v2.5.0","v2.5.0-rc0","v2.5.0-rc1","v2.5.0-rc2","v2.5.0-rc3","v2.5.0-rc4","v2.6.0","v2.6.0-rc0","v2.6.0-rc1","v2.6.0-rc2","v2.6.0-rc3","v2.6.0-rc4","v2.6.0-rc5","v2.7.0","v2.7.0-rc0","v2.7.0-rc1","v2.7.0-rc2","v2.7.0-rc3","v2.7.0-rc4","v2.7.0-rc5","v2.8.0","v2.8.0-rc0","v2.8.0-rc1","v2.8.0-rc2","v2.8.0-rc3","v2.8.0-rc4","v2.8.1","v2.8.1.1","v2.9.0-rc0","v2.9.0-rc1"],"database_specific":{"vanir_signatures_modified":"2026-04-11T04:59:31Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-8284.json","vanir_signatures":[{"target":{"file":"target/i386/translate.c","function":"disas_insn"},"signature_version":"v1","source":"https://github.com/qemu/qemu/commit/30663fd26c0307e414622c7a8607fbc04f92ec14","deprecated":false,"id":"CVE-2017-8284-44dad5dd","signature_type":"Function","digest":{"function_hash":"62858087643175459389038123897881956661","length":84726}},{"target":{"file":"target/i386/translate.c"},"signature_version":"v1","source":"https://github.com/qemu/qemu/commit/30663fd26c0307e414622c7a8607fbc04f92ec14","deprecated":false,"id":"CVE-2017-8284-691b8e18","signature_type":"Line","digest":{"threshold":0.9,"line_hashes":["6578780634270786687336334246437024637","174909187175943662593529517711432456963","25295187560342897628802647788980434776","321751920125528071603375534809250973200"]}}]}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}