Skip to content
Fencer Vulns
medium 5.0

CVE-2018-16872 json

A flaw was found in qemu Media Transfer Protocol (MTP).

published 2018-12-13 7 y ago modified 2026-06-17 4 mo ago also EUVD-2018-8663

cvss
5.0
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.1%
EPSS 1.1% chance of exploitation in 30 days, percentile 65%
public exploits
0
none known

Summary

A flaw was found in qemu Media Transfer Protocol (MTP). The code opening files in usb_mtp_get_object and usb_mtp_get_partial_object and directories in usb_mtp_object_readdir doesn't consider that the underlying filesystem may have changed since the time lstat(2) was called in usb_mtp_object_alloc, a classical TOCTTOU problem. An attacker with write access to the host filesystem shared with a guest can use this property to navigate the host filesystem in the context of the QEMU process and read any file the QEMU process has access to. Access to the filesystem may be local or via a network share protocol such as CIFS.

Patch / fix

  • qemu Debian 14, Debian 13, Debian 12 1:3.1+dfsg-2

debian advisories DEBIAN-CVE-2018-16872

  • qemu Ubuntu 18.04 LTS 1:2.11+dfsg-1ubuntu7.12

ubuntu advisories UBUNTU-CVE-2018-16872

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • qemu SLES for SAP 12 SP3, SLES 12 SP3, SLED 12 SP3 2.9.1-6.28.1
  • qemu SLES for SAP 12 SP2, SLES 12 SP2-LTSS, SLES 12 SP2-BCL +2 more 2.6.2-41.49.1
  • qemu SLES for SAP 12 SP4, SLES 12 SP4, SLED 12 SP4 2.11.2-5.8.1
  • qemu SLE Module for Server Applications 15, SLE Module for Basesystem 15 2.11.2-9.20.1
  • qemu SLES for SAP 12 SP1, SLES 12 SP1-LTSS 2.3.1-33.20.1

suse advisories SUSE-SU-2019:0471-2SUSE-SU-2019:0582-1SUSE-SU-2019:0489-1SUSE-SU-2019:0471-1SUSE-SU-2019:0435-1SUSE-SU-2019:0423-1

  • qemu openSUSE Tumbleweed 6.1.0-32.1

opensuse advisories openSUSE-SU-2024:11287-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-16872 updated cvss 5.0

QEMU: usb-mtp: path traversal by host filesystem manipulation in Media Transfer Protocol (MTP)

  • Red Hat Enterprise Linux 5 kvm, xen Red Hat Enterprise Linux 6 qemu-img, qemu-kvm, qemu-kvm-tools, qemu-guest-agent, qemu-guest-agent-win32 Red Hat Enterprise Linux 7 qemu-img, qemu-kvm, libcacard, qemu-img-ma, qemu-kvm-ma, qemu-kvm-rhev, +6 more Red Hat Enterprise Linux 8 qemu-img, qemu-kvm, qemu-kvm-core, qemu-kvm-tests, qemu-kvm-common, qemu-guest-agent, +8 more Red Hat OpenStack Platform 8 (Liberty) qemu-img-rhev, qemu-kvm-rhev, libcacard-rhev, qemu-kvm-tools-rhev, libcacard-devel-rhev, libcacard-tools-rhev, +1 more Red Hat OpenStack Platform 9 (Mitaka) qemu-img-rhev, qemu-kvm-rhev, libcacard-rhev, qemu-kvm-tools-rhev, libcacard-devel-rhev, libcacard-tools-rhev, +1 more
    +4 more products
    Red Hat OpenStack Platform 10 (Newton) qemu-img-rhev, qemu-kvm-rhev, qemu-kvm-tools-rhev, qemu-kvm-common-rhev Red Hat OpenStack Platform 12 (Pike) qemu-img-rhev, qemu-kvm-rhev, qemu-kvm-tools-rhev, qemu-kvm-common-rhev Red Hat OpenStack Platform 13 (Queens) qemu-img-rhev, qemu-kvm-rhev, qemu-kvm-tools-rhev, qemu-kvm-common-rhev Red Hat OpenStack Platform 14 (Rocky) qemu-img-rhev, qemu-kvm-rhev, qemu-kvm-tools-rhev, qemu-kvm-common-rhev
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.07% chance of exploitation in the next 30 days, higher than 65% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.0 5.0 CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:L
NVD 3.1 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD 2.0 3.5 AV:N/AC:M/Au:S/C:P/I:N/A:N

Affected products

  • [UNKNOWN] QEMU:

Classification

Weakness
  • CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.