Qemu : Security Vulnerabilities, CVEs, Published In 2017
The Virtio Vring implementation in QEMU allows local OS guest users to cause a denial of service (divide-by-zero error and QEMU process crash) by unsetting vring alignment while updating Virtio rings.
Max CVSS
6.5
EPSS Score
0.06%
Published
2017-12-07
Updated
2020-11-10
hw/input/ps2.c in Qemu does not validate 'rptr' and 'count' values during guest migration, leading to out-of-bounds access.
Max CVSS
10.0
EPSS Score
0.45%
Published
2017-11-17
Updated
2020-09-10
The mode4and5 write functions in hw/display/cirrus_vga.c in Qemu allow local OS guest privileged users to cause a denial of service (out-of-bounds write access and Qemu process crash) via vectors related to dst calculation.
Max CVSS
6.0
EPSS Score
0.06%
Published
2017-10-16
Updated
2020-11-10
Qemu through 2.10.0 allows remote attackers to cause a memory leak by triggering slow data-channel read operations, related to io/channel-websock.c.
Max CVSS
7.5
EPSS Score
0.71%
Published
2017-10-12
Updated
2019-10-03
Race condition in the v9fs_xattrwalk function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS users to obtain sensitive information from host heap memory via vectors related to reading extended attributes.
Max CVSS
5.6
EPSS Score
0.06%
Published
2017-10-10
Updated
2018-09-07
Integer overflow in the load_multiboot function in hw/i386/multiboot.c in QEMU (aka Quick Emulator) allows local guest OS users to execute arbitrary code on the host via crafted multiboot header address values, which trigger an out-of-bounds write.
Max CVSS
8.8
EPSS Score
0.06%
Published
2017-09-08
Updated
2020-11-16
Use-after-free vulnerability in the sofree function in slirp/socket.c in QEMU (aka Quick Emulator) allows attackers to cause a denial of service (QEMU instance crash) by leveraging failure to properly clear ifq_so from pending packets.
Max CVSS
7.5
EPSS Score
1.51%
Published
2017-09-01
Updated
2020-10-29
The vga display update in mis-calculated the region for the dirty bitmap snapshot in case split screen mode is used causing a denial of service (assertion failure) in the cpu_physical_memory_snapshot_get_dirty function.
Max CVSS
6.5
EPSS Score
0.28%
Published
2017-08-29
Updated
2019-10-03
QEMU (aka Quick Emulator), when built with the VGA display emulator support, allows local guest OS privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors involving display update.
Max CVSS
5.5
EPSS Score
0.07%
Published
2017-09-01
Updated
2020-11-10
QEMU (aka Quick Emulator), when built with the IDE disk and CD/DVD-ROM Emulator support, allows local guest OS privileged users to cause a denial of service (NULL pointer dereference and QEMU process crash) by flushing an empty CDROM device drive.
Max CVSS
6.5
EPSS Score
0.06%
Published
2017-08-23
Updated
2020-11-10
The dhcp_decode function in slirp/bootp.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (out-of-bounds read and QEMU process crash) via a crafted DHCP options string.
Max CVSS
5.5
EPSS Score
0.06%
Published
2017-07-25
Updated
2020-11-10
The address_space_write_continue function in exec.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (out-of-bounds access and guest instance crash) by leveraging use of qemu_map_ram_ptr to access guest ram block area.
Max CVSS
4.4
EPSS Score
0.06%
Published
2017-08-02
Updated
2020-11-10
Stack-based buffer overflow in hw/usb/redirect.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (QEMU process crash) via vectors related to logging debug messages.
Max CVSS
5.5
EPSS Score
0.07%
Published
2017-08-02
Updated
2020-11-10
qemu-nbd in QEMU (aka Quick Emulator) does not ignore SIGPIPE, which allows remote attackers to cause a denial of service (daemon crash) by disconnecting during a server-to-client reply attempt.
Max CVSS
7.5
EPSS Score
3.02%
Published
2017-08-02
Updated
2021-08-04
The qemu-nbd server in QEMU (aka Quick Emulator), when built with the Network Block Device (NBD) Server support, allows remote attackers to cause a denial of service (segmentation fault and server crash) by leveraging failure to ensure that all initialization occurs before talking to a client in the nbd_negotiate function.
Max CVSS
7.5
EPSS Score
2.59%
Published
2017-07-06
Updated
2020-10-29
QEMU (aka Quick Emulator), when built with MegaRAID SAS 8708EM2 Host Bus Adapter emulation support, allows local guest OS privileged users to cause a denial of service (NULL pointer dereference and QEMU process crash) via vectors involving megasas command processing.
Max CVSS
5.5
EPSS Score
0.06%
Published
2017-06-16
Updated
2020-11-10
QEMU (aka Quick Emulator), when built with USB xHCI controller emulator support, allows local guest OS privileged users to cause a denial of service (infinite recursive call) via vectors involving control transfer descriptors sequencing.
Max CVSS
5.5
EPSS Score
0.06%
Published
2017-06-16
Updated
2020-11-10
Memory leak in QEMU (aka Quick Emulator), when built with USB EHCI Emulation support, allows local guest OS privileged users to cause a denial of service (memory consumption) by repeatedly hot-unplugging the device.
Max CVSS
5.5
EPSS Score
0.06%
Published
2017-06-16
Updated
2020-11-10
Memory leak in QEMU (aka Quick Emulator), when built with IDE AHCI Emulation support, allows local guest OS privileged users to cause a denial of service (memory consumption) by repeatedly hot-unplugging the AHCI device.
Max CVSS
5.5
EPSS Score
0.06%
Published
2017-06-16
Updated
2020-11-10
QEMU (aka Quick Emulator) before 2.9.0, when built with the USB OHCI Emulation support, allows local guest OS users to cause a denial of service (infinite loop) by leveraging an incorrect return value, a different vulnerability than CVE-2017-6505.
Max CVSS
5.6
EPSS Score
0.06%
Published
2017-06-08
Updated
2020-11-10
QEMU (aka Quick Emulator), when built with the e1000e NIC emulation support, allows local guest OS privileged users to cause a denial of service (infinite loop) via vectors related to setting the initial receive / transmit descriptor head (TDH/RDH) outside the allocated descriptor buffer.
Max CVSS
5.6
EPSS Score
0.06%
Published
2017-06-08
Updated
2020-11-10
Memory leak in the virtio_gpu_set_scanout function in hw/display/virtio-gpu.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (memory consumption) via a large number of "VIRTIO_GPU_CMD_SET_SCANOUT:" commands.
Max CVSS
5.5
EPSS Score
0.06%
Published
2017-06-01
Updated
2020-11-10
Buffer overflow in the "megasas_mmio_write" function in Qemu 2.9.0 allows remote attackers to have unspecified impact via unknown vectors.
Max CVSS
9.8
EPSS Score
0.64%
Published
2017-08-28
Updated
2017-09-06
Memory leak in the keyboard input event handlers support in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption) by rapidly generating large keyboard events.
Max CVSS
6.5
EPSS Score
0.06%
Published
2017-05-23
Updated
2021-08-04
Memory leak in the audio/audio.c in QEMU (aka Quick Emulator) allows remote attackers to cause a denial of service (memory consumption) by repeatedly starting and stopping audio capture.
Max CVSS
7.8
EPSS Score
1.13%
Published
2017-05-23
Updated
2021-08-04