CVE-2018-20815 — QEMU: device_tree: heap buffer overflow while loading device tree blob

CRITICAL

QEMU: device_tree: heap buffer overflow while loading device tree blob

Published May 31, 2019

9.8

CRITICAL

CVSS 3.0

EPSS 4.43%

In QEMU 3.1.0, load_device_tree in device_tree.c calls the deprecated load_image function, which has a buffer overflow risk.

Red Hat Enterprise Linux 7

qemu-kvm-ma-10:2.12.0-18.el7_6.4

Fixed · RHSA-2019:1881
Red Hat Enterprise Linux 8

virt:rhel-8000020190510171727.55190bc5

Fixed · RHSA-2019:1175
Red Hat OpenStack Platform 10.0 (Newton)

qemu-kvm-rhev-10:2.12.0-18.el7_6.6

Fixed · RHSA-2019:1723
Red Hat OpenStack Platform 13.0 (Queens)

qemu-kvm-rhev-10:2.12.0-18.el7_6.6

Fixed · RHSA-2019:1743
Red Hat OpenStack Platform 14.0 (Rocky)

qemu-kvm-rhev-10:2.12.0-18.el7_6.6

Fixed · RHSA-2019:1667
Red Hat OpenStack Platform 9.0 (Mitaka)

qemu-kvm-rhev-10:2.12.0-18.el7_6.6

Fixed · RHSA-2019:2507
Red Hat Virtualization 4 for Red Hat Enterprise Linux 7

qemu-kvm-rhev-10:2.12.0-18.el7_6.7

Fixed · RHSA-2019:1968
Red Hat Virtualization 4 for Red Hat Enterprise Linux 7

qemu-kvm-rhev-10:2.12.0-33.el7

Fixed · RHSA-2019:2553
Red Hat Virtualization Engine 4.2

qemu-kvm-rhev-10:2.12.0-18.el7_6.7

Fixed · RHSA-2019:1968
Red Hat Virtualization Engine 4.3

qemu-kvm-rhev-10:2.12.0-18.el7_6.7

Fixed · RHSA-2019:1968
Red Hat Virtualization Engine 4.3

qemu-kvm-rhev-10:2.12.0-33.el7

Fixed · RHSA-2019:2553
Red Hat Enterprise Linux 5

kvm

Not affected
Red Hat Enterprise Linux 5

xen

Not affected
Red Hat Enterprise Linux 6

qemu-kvm

Not affected
Red Hat Enterprise Linux 7

qemu-kvm

Not affected
Red Hat OpenStack Platform 8 (Liberty)

qemu-kvm-rhev

Affected

Product	Package	State	Advisory
Red Hat Enterprise Linux 7	qemu-kvm-ma-10:2.12.0-18.el7_6.4	Fixed	RHSA-2019:1881
Red Hat Enterprise Linux 8	virt:rhel-8000020190510171727.55190bc5	Fixed	RHSA-2019:1175
Red Hat OpenStack Platform 10.0 (Newton)	qemu-kvm-rhev-10:2.12.0-18.el7_6.6	Fixed	RHSA-2019:1723
Red Hat OpenStack Platform 13.0 (Queens)	qemu-kvm-rhev-10:2.12.0-18.el7_6.6	Fixed	RHSA-2019:1743
Red Hat OpenStack Platform 14.0 (Rocky)	qemu-kvm-rhev-10:2.12.0-18.el7_6.6	Fixed	RHSA-2019:1667
Red Hat OpenStack Platform 9.0 (Mitaka)	qemu-kvm-rhev-10:2.12.0-18.el7_6.6	Fixed	RHSA-2019:2507
Red Hat Virtualization 4 for Red Hat Enterprise Linux 7	qemu-kvm-rhev-10:2.12.0-18.el7_6.7	Fixed	RHSA-2019:1968
Red Hat Virtualization 4 for Red Hat Enterprise Linux 7	qemu-kvm-rhev-10:2.12.0-33.el7	Fixed	RHSA-2019:2553
Red Hat Virtualization Engine 4.2	qemu-kvm-rhev-10:2.12.0-18.el7_6.7	Fixed	RHSA-2019:1968
Red Hat Virtualization Engine 4.3	qemu-kvm-rhev-10:2.12.0-18.el7_6.7	Fixed	RHSA-2019:1968
Red Hat Virtualization Engine 4.3	qemu-kvm-rhev-10:2.12.0-33.el7	Fixed	RHSA-2019:2553
Red Hat Enterprise Linux 5	kvm	Not affected	n/a
Red Hat Enterprise Linux 5	xen	Not affected	n/a
Red Hat Enterprise Linux 6	qemu-kvm	Not affected	n/a
Red Hat Enterprise Linux 7	qemu-kvm	Not affected	n/a
Red Hat OpenStack Platform 8 (Liberty)	qemu-kvm-rhev	Affected	n/a

No remediation recorded yet.

4.43% 0.04428

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 1, 2026.

EPSS probability 0.04428

2021–2026

Table of values (22 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 1, 2026	4.43% (0.04428)	91.06th	v5 (v2026.06.15)
Jun 15, 2026	4.43% (0.04428)	90.09th	v5 (v2026.06.15)
Jan 6, 2026	3.93% (0.03933)	87.97th	v4 (v2025.03.14)
Dec 14, 2025	2.92% (0.02918)	85.94th	v4 (v2025.03.14)
Nov 21, 2025	1.60% (0.01604)	81.15th	v4 (v2025.03.14)
Nov 18, 2025	3.47% (0.03469)	86.35th	v4 (v2025.03.14)
Apr 3, 2025	1.89% (0.01888)	81.62th	v4 (v2025.03.14)
Mar 30, 2025	3.47% (0.03469)	86.44th	v4 (v2025.03.14)
Mar 29, 2025	6.45% (0.06451)	84.67th	v4 (v2025.03.14)
Mar 17, 2025	2.90% (0.02905)	85.44th	v4 (v2025.03.14)
Dec 12, 2024	1.07% (0.01068)	84.84th	v3 (v2023.03.01)
May 24, 2024	1.07% (0.01068)	84.16th	v3 (v2023.03.01)
Mar 19, 2024	0.95% (0.00950)	82.80th	v3 (v2023.03.01)
Mar 7, 2023	0.95% (0.00950)	80.79th	v3 (v2023.03.01)
Mar 6, 2023	1.54% (0.01537)	74.52th	v2 (v2022.01.01)
Feb 23, 2023	1.54% (0.01537)	74.48th	v2 (v2022.01.01)
Apr 1, 2022	1.54% (0.01537)	72.41th	v2 (v2022.01.01)
Feb 4, 2022	1.54% (0.01537)	51.33th	v2 (v2022.01.01)
Feb 3, 2022	2.68% (0.02678)	55.40th	v1
Jan 6, 2022	2.68% (0.02678)	54.96th	v1
Sep 1, 2021	2.68% (0.02678)	79.35th	v1
Apr 14, 2021	2.68% (0.02678)	0.00th	v1

Weaknesses (2)

CWE-119

Buffer Overflow

CWE-122

Link	Providers	Tags
https://access.redhat.com/errata/RHSA-2019:1667		vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2019:1723		vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2019:1743		vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2019:1881		vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2019:1968		vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2019:2507		vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/errata/RHSA-2019:2553		vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2018-20815		Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1693101		Issue Tracking
https://git.qemu.org/?p=qemu.git%3Ba=commitdiff%3Bh=da885fe1ee8b4589047484bd7fa05a4905b52b17		x_refsource_MISC
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BOE3PVFPMWMXV3DGP2R3XIHAF2ZQU3FS/		vendor-advisoryx_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RVDHJB2QKXNDU7OFXIHIL5O5VN5QCSZL/		vendor-advisoryx_refsource_FEDORA
https://nvd.nist.gov/vuln/detail/CVE-2018-20815
https://seclists.org/bugtraq/2019/Aug/41		mailing-listx_refsource_BUGTRAQ
https://www.cve.org/CVERecord?id=CVE-2018-20815
https://www.debian.org/security/2019/dsa-4506		vendor-advisoryx_refsource_DEBIAN