critical
CVE-2018-20815
QEMU: device_tree: heap buffer overflow while loading device tree blob
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat7.0CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by Red Hat (high), Amazon (high), Oracle (high), Ubuntu (medium).
Description
In QEMU 3.1.0, load_device_tree in device_tree.c calls the deprecated load_image function, which has a buffer overflow risk.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| amazon linux 2 | ivshmem-tools, qemu, qemu-audio-alsa and 25 more | 10:3.1.0-7.amzn2.0.1 |
| debian 11 | qemu | 1:3.1+dfsg-7 |
| debian 12 | qemu | 1:3.1+dfsg-7 |
| debian 13 | qemu | 1:3.1+dfsg-7 |
| debian 14 | qemu | 1:3.1+dfsg-7 |
| debian 8 | qemu | 1:2.1+dfsg-12+deb8u11 |
| debian 9 | qemu | 1:2.8+dfsg-6+deb9u8 |
| echo | qemu | 1:3.1+dfsg-7 |
| Oracle Linux 7 | ivshmem-tools, qemu, qemu-block-gluster and 8 more | 15:3.1.0-3.el7 |
| Oracle Linux 8 | hivex, hivex-devel, libguestfs and 93 more | 1.3.15-6.module+el8.0.0+5219+3c0c6858 and 14 more |
| Red Hat | libcacard-devel-rhev, libcacard-rhev, libcacard-tools-rhev and 4 more | no fix listed |
| ubuntu 14.04 | qemu | 2.0.0+dfsg-2ubuntu1.46 |
Show all 162 entries from 24 sources
| Source | Package | Fixed in |
|---|---|---|
| amazon linux 2 | ivshmem-tools | 10:3.1.0-7.amzn2.0.1 |
| amazon linux 2 | qemu | 10:3.1.0-7.amzn2.0.1 |
| amazon linux 2 | qemu-audio-alsa | 10:3.1.0-7.amzn2.0.1 |
| amazon linux 2 | qemu-audio-oss | 10:3.1.0-7.amzn2.0.1 |
| amazon linux 2 | qemu-audio-pa | 10:3.1.0-7.amzn2.0.1 |
| amazon linux 2 | qemu-audio-sdl | 10:3.1.0-7.amzn2.0.1 |
| amazon linux 2 | qemu-block-curl | 10:3.1.0-7.amzn2.0.1 |
| amazon linux 2 | qemu-block-dmg | 10:3.1.0-7.amzn2.0.1 |
| amazon linux 2 | qemu-block-iscsi | 10:3.1.0-7.amzn2.0.1 |
| amazon linux 2 | qemu-block-nfs | 10:3.1.0-7.amzn2.0.1 |
| amazon linux 2 | qemu-block-rbd | 10:3.1.0-7.amzn2.0.1 |
| amazon linux 2 | qemu-block-ssh | 10:3.1.0-7.amzn2.0.1 |
| amazon linux 2 | qemu-common | 10:3.1.0-7.amzn2.0.1 |
| amazon linux 2 | qemu-debuginfo | 10:3.1.0-7.amzn2.0.1 |
| amazon linux 2 | qemu-guest-agent | 10:3.1.0-7.amzn2.0.1 |
| amazon linux 2 | qemu-img | 10:3.1.0-7.amzn2.0.1 |
| amazon linux 2 | qemu-kvm | 10:3.1.0-7.amzn2.0.1 |
| amazon linux 2 | qemu-kvm-core | 10:3.1.0-7.amzn2.0.1 |
| amazon linux 2 | qemu-system-aarch64 | 10:3.1.0-7.amzn2.0.1 |
| amazon linux 2 | qemu-system-aarch64-core | 10:3.1.0-7.amzn2.0.1 |
| amazon linux 2 | qemu-system-x86 | 10:3.1.0-7.amzn2.0.1 |
| amazon linux 2 | qemu-system-x86-core | 10:3.1.0-7.amzn2.0.1 |
| amazon linux 2 | qemu-ui-curses | 10:3.1.0-7.amzn2.0.1 |
| amazon linux 2 | qemu-ui-gtk | 10:3.1.0-7.amzn2.0.1 |
| amazon linux 2 | qemu-ui-sdl | 10:3.1.0-7.amzn2.0.1 |
| amazon linux 2 | qemu-user | 10:3.1.0-7.amzn2.0.1 |
| amazon linux 2 | qemu-user-binfmt | 10:3.1.0-7.amzn2.0.1 |
| amazon linux 2 | qemu-user-static | 10:3.1.0-7.amzn2.0.1 |
| debian 11 | qemu | 1:3.1+dfsg-7 |
| debian 12 | qemu | 1:3.1+dfsg-7 |
| debian 13 | qemu | 1:3.1+dfsg-7 |
| debian 14 | qemu | 1:3.1+dfsg-7 |
| debian 8 | qemu | 1:2.1+dfsg-12+deb8u11 |
| debian 9 | qemu | 1:2.8+dfsg-6+deb9u8 |
| echo | qemu | 1:3.1+dfsg-7 |
| Oracle Linux 7 | ivshmem-tools | 15:3.1.0-3.el7 |
| Oracle Linux 7 | qemu | 15:3.1.0-3.el7 |
| Oracle Linux 7 | qemu-block-gluster | 15:3.1.0-3.el7 |
| Oracle Linux 7 | qemu-block-iscsi | 15:3.1.0-3.el7 |
| Oracle Linux 7 | qemu-block-rbd | 15:3.1.0-3.el7 |
| Oracle Linux 7 | qemu-common | 15:3.1.0-3.el7 |
| Oracle Linux 7 | qemu-img | 15:3.1.0-3.el7 |
| Oracle Linux 7 | qemu-kvm | 15:3.1.0-3.el7 |
| Oracle Linux 7 | qemu-kvm-core | 15:3.1.0-3.el7 |
| Oracle Linux 7 | qemu-system-aarch64 | 15:3.1.0-3.el7 |
| Oracle Linux 7 | qemu-system-aarch64-core | 15:3.1.0-3.el7 |
| Oracle Linux 8 | hivex | 1.3.15-6.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | hivex-devel | 1.3.15-6.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libguestfs | 1:1.38.4-10.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libguestfs-bash-completion | 1:1.38.4-10.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libguestfs-benchmarking | 1:1.38.4-10.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libguestfs-devel | 1:1.38.4-10.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libguestfs-gfs2 | 1:1.38.4-10.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libguestfs-gobject | 1:1.38.4-10.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libguestfs-gobject-devel | 1:1.38.4-10.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libguestfs-inspect-icons | 1:1.38.4-10.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libguestfs-java | 1:1.38.4-10.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libguestfs-java-devel | 1:1.38.4-10.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libguestfs-javadoc | 1:1.38.4-10.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libguestfs-man-pages-ja | 1:1.38.4-10.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libguestfs-man-pages-uk | 1:1.38.4-10.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libguestfs-rescue | 1:1.38.4-10.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libguestfs-rsync | 1:1.38.4-10.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libguestfs-tools | 1:1.38.4-10.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libguestfs-tools-c | 1:1.38.4-10.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libguestfs-winsupport | 8.0-2.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libguestfs-xfs | 1:1.38.4-10.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libiscsi | 1.18.0-6.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libiscsi-devel | 1.18.0-6.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libiscsi-utils | 1.18.0-6.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libssh2 | 1.8.0-7.module+el8.0.0+5219+3c0c6858.1 |
| Oracle Linux 8 | libvirt | 4.5.0-23.1.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libvirt-admin | 4.5.0-23.1.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libvirt-bash-completion | 4.5.0-23.1.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libvirt-client | 4.5.0-23.1.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libvirt-daemon | 4.5.0-23.1.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libvirt-daemon-config-network | 4.5.0-23.1.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libvirt-daemon-config-nwfilter | 4.5.0-23.1.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libvirt-daemon-driver-interface | 4.5.0-23.1.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libvirt-daemon-driver-network | 4.5.0-23.1.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libvirt-daemon-driver-nodedev | 4.5.0-23.1.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libvirt-daemon-driver-nwfilter | 4.5.0-23.1.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libvirt-daemon-driver-qemu | 4.5.0-23.1.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libvirt-daemon-driver-secret | 4.5.0-23.1.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libvirt-daemon-driver-storage | 4.5.0-23.1.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libvirt-daemon-driver-storage-core | 4.5.0-23.1.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libvirt-daemon-driver-storage-disk | 4.5.0-23.1.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libvirt-daemon-driver-storage-gluster | 4.5.0-23.1.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libvirt-daemon-driver-storage-iscsi | 4.5.0-23.1.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libvirt-daemon-driver-storage-logical | 4.5.0-23.1.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libvirt-daemon-driver-storage-mpath | 4.5.0-23.1.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libvirt-daemon-driver-storage-rbd | 4.5.0-23.1.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libvirt-daemon-driver-storage-scsi | 4.5.0-23.1.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libvirt-daemon-kvm | 4.5.0-23.1.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libvirt-dbus | 1.2.0-2.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libvirt-devel | 4.5.0-23.1.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libvirt-docs | 4.5.0-23.1.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libvirt-libs | 4.5.0-23.1.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libvirt-lock-sanlock | 4.5.0-23.1.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | libvirt-nss | 4.5.0-23.1.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | lua-guestfs | 1:1.38.4-10.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | nbdkit | 1.4.2-4.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | nbdkit-bash-completion | 1.4.2-4.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | nbdkit-basic-plugins | 1.4.2-4.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | nbdkit-devel | 1.4.2-4.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | nbdkit-example-plugins | 1.4.2-4.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | nbdkit-plugin-gzip | 1.4.2-4.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | nbdkit-plugin-python-common | 1.4.2-4.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | nbdkit-plugin-python3 | 1.4.2-4.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | nbdkit-plugin-vddk | 1.4.2-4.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | nbdkit-plugin-xz | 1.4.2-4.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | netcf | 0.2.8-10.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | netcf-devel | 0.2.8-10.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | netcf-libs | 0.2.8-10.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | perl-Sys-Guestfs | 1:1.38.4-10.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | perl-Sys-Virt | 4.5.0-4.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | perl-hivex | 1.3.15-6.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | python3-hivex | 1.3.15-6.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | python3-libguestfs | 1:1.38.4-10.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | python3-libvirt | 4.5.0-1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | qemu-guest-agent | 15:2.12.0-64.module+el8.0.0+5219+3c0c6858.2 |
| Oracle Linux 8 | qemu-img | 15:2.12.0-64.module+el8.0.0+5219+3c0c6858.2 |
| Oracle Linux 8 | qemu-kvm | 15:2.12.0-64.module+el8.0.0+5219+3c0c6858.2 |
| Oracle Linux 8 | qemu-kvm-block-curl | 15:2.12.0-64.module+el8.0.0+5219+3c0c6858.2 |
| Oracle Linux 8 | qemu-kvm-block-gluster | 15:2.12.0-64.module+el8.0.0+5219+3c0c6858.2 |
| Oracle Linux 8 | qemu-kvm-block-iscsi | 15:2.12.0-64.module+el8.0.0+5219+3c0c6858.2 |
| Oracle Linux 8 | qemu-kvm-block-rbd | 15:2.12.0-64.module+el8.0.0+5219+3c0c6858.2 |
| Oracle Linux 8 | qemu-kvm-block-ssh | 15:2.12.0-64.module+el8.0.0+5219+3c0c6858.2 |
| Oracle Linux 8 | qemu-kvm-common | 15:2.12.0-64.module+el8.0.0+5219+3c0c6858.2 |
| Oracle Linux 8 | qemu-kvm-core | 15:2.12.0-64.module+el8.0.0+5219+3c0c6858.2 |
| Oracle Linux 8 | ruby-hivex | 1.3.15-6.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | ruby-libguestfs | 1:1.38.4-10.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | seabios | 1.11.1-3.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | seabios-bin | 1.11.1-3.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | seavgabios-bin | 1.11.1-3.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | sgabios | 1:0.20170427git-2.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | sgabios-bin | 1:0.20170427git-2.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | supermin | 5.1.19-8.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | supermin-devel | 5.1.19-8.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | virt-dib | 1:1.38.4-10.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | virt-p2v-maker | 1:1.38.4-10.0.1.module+el8.0.0+5219+3c0c6858 |
| Oracle Linux 8 | virt-v2v | 1:1.38.4-10.0.1.module+el8.0.0+5219+3c0c6858 |
| Red Hat | libcacard-devel-rhev | no fix listed |
| Red Hat | libcacard-rhev | no fix listed |
| Red Hat | libcacard-tools-rhev | no fix listed |
| Red Hat | qemu-img-rhev | no fix listed |
| Red Hat | qemu-kvm-common-rhev | no fix listed |
| Red Hat | qemu-kvm-rhev | no fix listed |
| Red Hat | qemu-kvm-tools-rhev | no fix listed |
| ubuntu 14.04 | qemu | 2.0.0+dfsg-2ubuntu1.46 |
| ubuntu 14.04-ESM | qemu | 2.0.0+dfsg-2ubuntu1.46 |
| ubuntu 16.04 | qemu | 1:2.5+dfsg-5ubuntu10.38 |
| ubuntu 16.04-ESM | qemu | 1:2.5+dfsg-5ubuntu10.38 |
| ubuntu 18.04 | qemu | 1:2.11+dfsg-1ubuntu7.13 |
| ubuntu 18.04-ESM | qemu | 1:2.11+dfsg-1ubuntu7.13 |
| ubuntu 18.10 | qemu | 1:2.12+dfsg-3ubuntu8.7 |
| ubuntu 19.04 | qemu | 1:3.1+dfsg-2ubuntu3.1 |
| ubuntu 19.10 | qemu | 1:3.1+dfsg-2ubuntu4 |
| ubuntu 20.04 | qemu | 1:3.1+dfsg-2ubuntu4 |
| ubuntu 20.04-ESM | qemu | 1:3.1+dfsg-2ubuntu4 |
| ubuntu 20.10 | qemu | 1:3.1+dfsg-2ubuntu4 |
| ubuntu 21.04 | qemu | 1:3.1+dfsg-2ubuntu4 |
References
- https://access.redhat.com/errata/RHSA-2019:1667
- https://access.redhat.com/errata/RHSA-2019:1723
- https://access.redhat.com/errata/RHSA-2019:1743
- https://access.redhat.com/errata/RHSA-2019:1881
- https://access.redhat.com/errata/RHSA-2019:1968
- https://access.redhat.com/errata/RHSA-2019:2507
- https://access.redhat.com/errata/RHSA-2019:2553
- https://access.redhat.com/security/cve/CVE-2018-20815
All 19 references
- https://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=da885fe1ee8b4589047484bd7fa05a4905b52b17
- https://linux.oracle.com/cve/CVE-2018-20815.html
- https://linux.oracle.com/errata/ELSA-2019-4640.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BOE3PVFPMWMXV3DGP2R3XIHAF2ZQU3FS/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RVDHJB2QKXNDU7OFXIHIL5O5VN5QCSZL/
- https://nvd.nist.gov/vuln/detail/CVE-2018-20815
- https://seclists.org/bugtraq/2019/Aug/41
- https://ubuntu.com/security/notices/USN-3978-1
- https://www.cve.org/CVERecord?id=CVE-2018-20815
- https://www.debian.org/security/2019/dsa-4506
- https://www.openwall.com/lists/oss-security/2019/03/27/1