Qemu : Security Vulnerabilities

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2023-1544	770		2023-03-23	2023-05-11	0.0	None	???	???	???	???	???	???
A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to allocate and initialize a huge number of page tables to be used as a ring of descriptors for CQ and async events, potentially leading to an out-of-bounds read and crash of QEMU.
2	CVE-2023-0330	787	Overflow Mem. Corr.	2023-03-06	2023-03-28	0.0	None	???	???	???	???	???	???
A vulnerability in the lsi53c895a device affects the latest version of qemu. A DMA-MMIO reentrancy problem may lead to memory corruption bugs like stack overflow or use-after-free.
3	CVE-2022-26354	772		2022-03-16	2023-02-12	2.1	None	Local	Low	Not required	None	None	Partial
A flaw was found in the vhost-vsock device of QEMU. In case of error, an invalid element was not detached from the virtqueue before freeing its memory, leading to memory leakage and other unexpected results. Affected QEMU versions <= 6.2.0.
4	CVE-2022-4172	190	Overflow	2022-11-29	2023-02-01	0.0	None	???	???	???	???	???	???
An integer overflow and buffer overflow issues were found in the ACPI Error Record Serialization Table (ERST) device of QEMU in the read_erst_record() and write_erst_record() functions. Both issues may allow the guest to overrun the host buffer allocated for the ERST memory device. A malicious guest could use these flaws to crash the QEMU process on the host.
5	CVE-2022-4144	125	DoS	2022-11-29	2023-03-29	0.0	None	???	???	???	???	???	???
An out-of-bounds read flaw was found in the QXL display device emulation in QEMU. The qxl_phys2virt() function does not check the size of the structure pointed to by the guest physical address, potentially reading past the end of the bar space into adjacent pages. A malicious guest user could use this flaw to crash the QEMU process on the host causing a denial of service condition.
6	CVE-2022-3872	193	DoS	2022-11-07	2023-02-23	0.0	None	???	???	???	???	???	???
An off-by-one read/write issue was found in the SDHCI device of QEMU. It occurs when reading/writing the Buffer Data Port Register in sdhci_read_dataport and sdhci_write_dataport, respectively, if data_count == block_size. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.
7	CVE-2022-3165	191	DoS	2022-10-17	2023-01-20	0.0	None	???	???	???	???	???	???
An integer underflow issue was found in the QEMU VNC server while processing ClientCutText messages in the extended format. A malicious client could use this flaw to make QEMU unresponsive by sending a specially crafted payload message, resulting in a denial of service.
8	CVE-2022-2962	787	DoS Overflow	2022-09-13	2022-09-30	0.0	None	???	???	???	???	???	???
A DMA reentrancy issue was found in the Tulip device emulation in QEMU. When Tulip reads or writes to the rx/tx descriptor or copies the rx/tx frame, it doesn't check whether the destination address is its own MMIO address. This can cause the device to trigger MMIO handlers multiple times, possibly leading to a stack or heap overflow. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.
9	CVE-2022-0358	273	+Priv	2022-08-29	2022-12-09	0.0	None	???	???	???	???	???	???
A flaw was found in the QEMU virtio-fs shared file system daemon (virtiofsd) implementation. This flaw is strictly related to CVE-2018-13405. A local guest user can create files in the directories shared by virtio-fs with unintended group ownership in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of the group. This could allow a malicious unprivileged user inside the guest to gain access to resources accessible to the root group, potentially escalating their privileges within the guest. A malicious local user in the host might also leverage this unexpected executable file created by the guest to escalate their privileges on the host system.
10	CVE-2022-0216	416	DoS	2022-08-26	2023-02-12	0.0	None	???	???	???	???	???	???
A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of QEMU. The flaw occurs while processing repeated messages to cancel the current SCSI request via the lsi_do_msgout function. This flaw allows a malicious privileged user within the guest to crash the QEMU process on the host, resulting in a denial of service.
11	CVE-2021-20295	125		2022-04-01	2022-10-06	2.1	None	Local	Low	Not required	Partial	None	None
It was discovered that the update for the virt:rhel module in the RHSA-2020:4676 (https://access.redhat.com/errata/RHSA-2020:4676) erratum released as part of Red Hat Enterprise Linux 8.3 failed to include the fix for the qemu-kvm component issue CVE-2020-10756, which was previously corrected in virt:rhel/qemu-kvm via erratum RHSA-2020:4059 (https://access.redhat.com/errata/RHSA-2020:4059). CVE-2021-20295 was assigned to that Red Hat specific security regression. For more details about the original security issue CVE-2020-10756, refer to bug 1835986 or the CVE page: https://access.redhat.com/security/cve/CVE-2020-10756.
12	CVE-2021-20263	281		2021-03-09	2022-09-30	2.1	None	Local	Low	Not required	None	Partial	None
A flaw was found in the virtio-fs shared file system daemon (virtiofsd) of QEMU. The new 'xattrmap' option may cause the 'security.capability' xattr in the guest to not drop on file write, potentially leading to a modified, privileged executable in the guest. In rare circumstances, this flaw could be used by a malicious user to elevate their privileges within the guest.
13	CVE-2021-20257	835	DoS	2022-03-16	2023-02-12	2.1	None	Local	Low	Not required	None	None	Partial
An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx) descriptors in process_tx_desc if various descriptor fields are initialized with invalid values. This flaw allows a guest to consume CPU cycles on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
14	CVE-2021-20255	674	DoS Overflow	2021-03-09	2022-08-05	2.1	None	Local	Low	Not required	None	None	Partial
A stack overflow via an infinite recursion vulnerability was found in the eepro100 i8255x device emulator of QEMU. This issue occurs while processing controller commands due to a DMA reentry issue. This flaw allows a guest user or process to consume CPU cycles or crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
15	CVE-2021-20221	125		2021-05-13	2023-02-12	2.1	None	Local	Low	Not required	None	None	Partial
An out-of-bounds heap buffer access issue was found in the ARM Generic Interrupt Controller emulator of QEMU up to and including qemu 4.2.0on aarch64 platform. The issue occurs because while writing an interrupt ID to the controller memory area, it is not masked to be 4 bits wide. It may lead to the said issue while updating controller state fields and their subsequent processing. A privileged guest user may use this flaw to crash the QEMU process on the host resulting in DoS scenario.
16	CVE-2021-20203	190	Overflow	2021-02-25	2022-09-30	2.1	None	Local	Low	Not required	None	None	Partial
An integer overflow issue was found in the vmxnet3 NIC emulator of the QEMU for versions up to v5.2.0. It may occur if a guest was to supply invalid values for rx/tx queue size or other NIC parameters. A privileged guest user may use this flaw to crash the QEMU process on the host resulting in DoS scenario.
17	CVE-2021-20196	476	DoS	2021-05-26	2023-02-12	2.1	None	Local	Low	Not required	None	None	Partial
A NULL pointer dereference flaw was found in the floppy disk emulator of QEMU. This issue occurs while processing read/write ioport commands if the selected floppy drive is not initialized with a block device. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
18	CVE-2021-4158	476	DoS	2022-08-24	2023-02-12	0.0	None	???	???	???	???	???	???
A NULL pointer dereference issue was found in the ACPI code of QEMU. A malicious, privileged user within the guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.
19	CVE-2021-3947	125	Overflow	2022-02-18	2022-10-25	2.1	None	Local	Low	Not required	Partial	None	None
A stack-buffer-overflow was found in QEMU in the NVME component. The flaw lies in nvme_changed_nslist() where a malicious guest controlling certain input can read out of bounds memory. A malicious user could use this flaw leading to disclosure of sensitive information.
20	CVE-2021-3930	193	DoS	2022-02-18	2022-10-25	2.1	None	Local	Low	Not required	None	None	Partial
An off-by-one error was found in the SCSI device emulation in QEMU. It could occur while processing MODE SELECT commands in mode_sense_page() if the 'page' argument was set to MODE_PAGE_ALLS (0x3f). A malicious guest could use this flaw to potentially crash QEMU, resulting in a denial of service condition.
21	CVE-2021-3929	416	DoS	2022-08-25	2022-10-01	0.0	None	???	???	???	???	???	???
A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is similar to CVE-2021-3750 and, just like it, when the reentrancy write triggers the reset function nvme_ctrl_reset(), data structs will be freed leading to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition or, potentially, executing arbitrary code within the context of the QEMU process on the host.
22	CVE-2021-3735	400	DoS	2022-08-26	2022-09-01	0.0	None	???	???	???	???	???	???
A deadlock issue was found in the AHCI controller device of QEMU. It occurs on a software reset (ahci_reset_port) while handling a host-to-device Register FIS (Frame Information Structure) packet from the guest. A privileged user inside the guest could use this flaw to hang the QEMU process on the host, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability.
23	CVE-2021-3638	787	DoS	2022-03-03	2023-02-23	2.1	None	Local	Low	Not required	None	None	Partial
An out-of-bounds memory access flaw was found in the ATI VGA device emulation of QEMU. This flaw occurs in the ati_2d_blt() routine while handling MMIO write operations when the guest provides invalid values for the destination display parameters. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service.
24	CVE-2021-3611	119	DoS Overflow	2022-05-11	2023-02-12	2.1	None	Local	Low	Not required	None	None	Partial
A stack overflow vulnerability was found in the Intel HD Audio device (intel-hda) of QEMU. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability. This flaw affects QEMU versions prior to 7.0.0.
25	CVE-2021-3582	119	Overflow	2022-03-25	2022-10-05	2.1	None	Local	Low	Not required	None	None	Partial
A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. The issue occurs while handling a "PVRDMA_CMD_CREATE_MR" command due to improper memory remapping (mremap). This flaw allows a malicious guest to crash the QEMU process on the host. The highest threat from this vulnerability is to system availability.
26	CVE-2021-3545	908	+Info	2021-06-02	2022-10-25	2.1	None	Local	Low	Not required	Partial	None	None
An information disclosure vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0. The flaw exists in virgl_cmd_get_capset_info() in contrib/vhost-user-gpu/virgl.c and could occur due to the read of uninitialized memory. A malicious guest could exploit this issue to leak memory from the host.
27	CVE-2021-3544	401		2021-06-02	2022-10-25	2.1	None	Local	Low	Not required	None	None	Partial
Several memory leaks were found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0. They exist in contrib/vhost-user-gpu/vhost-user-gpu.c and contrib/vhost-user-gpu/virgl.c due to improper release of memory (i.e., free) after effective lifetime.
28	CVE-2021-3527	770	DoS	2021-05-26	2022-09-30	2.1	None	Local	Low	Not required	None	None	Partial
A flaw was found in the USB redirector device (usb-redir) of QEMU. Small USB packets are combined into a single, large transfer request, to reduce the overhead and improve performance. The combined size of the bulk transfer is used to dynamically allocate a variable length array (VLA) on the stack without proper validation. Since the total size is not bounded, a malicious guest could use this flaw to influence the array length and cause the QEMU process to perform an excessive allocation on the stack, resulting in a denial of service.
29	CVE-2021-3416	835	Overflow Bypass	2021-03-18	2023-02-12	2.1	None	Local	Low	Not required	None	None	Partial
A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions up to and including 5.2.0. The issue occurs in loopback mode of a NIC wherein reentrant DMA checks get bypassed. A guest user/process may use this flaw to consume CPU cycles or crash the QEMU process on the host resulting in DoS scenario.
30	CVE-2021-3392	416	DoS	2021-03-23	2022-09-30	2.1	None	Local	Low	Not required	None	None	Partial
A use-after-free flaw was found in the MegaRAID emulator of QEMU. This issue occurs while processing SCSI I/O requests in the case of an error mptsas_free_request() that does not dequeue the request object 'req' from a pending requests queue. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. Versions between 2.10.0 and 5.2.0 are potentially affected.
31	CVE-2020-35505	476	DoS	2021-05-28	2022-09-22	2.1	None	Local	Low	Not required	None	None	Partial
A NULL pointer dereference flaw was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0. This issue occurs while handling the 'Information Transfer' command. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
32	CVE-2020-35504	476	DoS	2021-05-28	2022-09-22	2.1	None	Local	Low	Not required	None	None	Partial
A NULL pointer dereference flaw was found in the SCSI emulation support of QEMU in versions before 6.0.0. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
33	CVE-2020-35503	476	DoS	2021-06-02	2022-05-13	2.1	None	Local	Low	Not required	None	None	Partial
A NULL pointer dereference flaw was found in the megasas-gen2 SCSI host bus adapter emulation of QEMU in versions before and including 6.0. This issue occurs in the megasas_command_cancelled() callback function while dropping a SCSI request. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
34	CVE-2020-28916	835		2020-12-04	2022-09-30	2.1	None	Local	Low	Not required	None	None	Partial
hw/net/e1000e_core.c in QEMU 5.0.0 has an infinite loop via an RX descriptor with a NULL buffer address.
35	CVE-2020-27821	787	DoS	2020-12-08	2022-09-30	2.1	None	Local	Low	Not required	None	None	Partial
A flaw was found in the memory management API of QEMU during the initialization of a memory region cache. This issue could lead to an out-of-bounds write access to the MSI-X table while performing MMIO operations. A guest user may abuse this flaw to crash the QEMU process on the host, resulting in a denial of service. This flaw affects QEMU versions prior to 5.2.0.
36	CVE-2020-27661	369	DoS	2021-06-02	2022-05-13	2.1	None	Local	Low	Not required	None	None	Partial
A divide-by-zero issue was found in dwc2_handle_packet in hw/usb/hcd-dwc2.c in the hcd-dwc2 USB host controller emulation of QEMU. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service.
37	CVE-2020-25743	476		2020-10-06	2020-10-07	2.1	None	Local	Low	Not required	None	None	Partial
hw/ide/pci.c in QEMU before 5.1.1 can trigger a NULL pointer dereference because it lacks a pointer check before an ide_cancel_dma_sync call.
38	CVE-2020-25742	476		2020-10-06	2020-10-07	2.1	None	Local	Low	Not required	None	None	Partial
pci_change_irq_level in hw/pci/pci.c in QEMU before 5.1.1 has a NULL pointer dereference because pci_get_bus() might not return a valid pointer.
39	CVE-2020-25741	476		2020-10-02	2020-10-14	2.1	None	Local	Low	Not required	None	None	Partial
fdctrl_write_data in hw/block/fdc.c in QEMU 5.0.0 has a NULL pointer dereference via a NULL block pointer for the current drive.
40	CVE-2020-25723	617	DoS	2020-12-02	2022-09-30	2.1	None	Local	Low	Not required	None	None	Partial
A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB requests due to missing handling of DMA memory map failure. A malicious privileged user within the guest may abuse this flaw to send bogus USB requests and crash the QEMU process on the host, resulting in a denial of service.
41	CVE-2020-25084	416		2020-09-25	2022-09-23	2.1	None	Local	Low	Not required	None	None	Partial
QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not checked.
42	CVE-2020-24352	119	DoS Overflow	2020-10-16	2021-07-21	2.1	None	Local	Low	Not required	None	None	Partial
An issue was discovered in QEMU through 5.1.0. An out-of-bounds memory access was found in the ATI VGA device implementation. This flaw occurs in the ati_2d_blt() routine in hw/display/ati_2d.c while handling MMIO write operations through the ati_mm_write() callback. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service.
43	CVE-2020-16092	617	DoS	2020-08-11	2022-09-30	2.1	None	Local	Low	Not required	None	None	Partial
In QEMU through 5.0.0, an assertion failure can occur in the network packet processing. This issue affects the e1000e and vmxnet3 network devices. A malicious guest user/process could use this flaw to abort the QEMU process on the host, resulting in a denial of service condition in net_tx_pkt_add_raw_fragment in hw/net/net_tx_pkt.c.
44	CVE-2020-15859	416		2020-07-21	2022-09-23	2.1	None	Local	Low	Not required	None	None	Partial
QEMU 4.2.0 has a use-after-free in hw/net/e1000e_core.c because a guest OS user can trigger an e1000e packet with the data's address set to the e1000e's MMIO address.
45	CVE-2020-15469	476		2020-07-02	2022-09-23	2.1	None	Local	Low	Not required	None	None	Partial
In QEMU 4.2.0, a MemoryRegionOps object may lack read/write callback methods, leading to a NULL pointer dereference.
46	CVE-2020-14415	369		2020-08-27	2020-09-02	2.1	None	Local	Low	Not required	None	None	Partial
oss_write in audio/ossaudio.c in QEMU before 5.0.0 mishandles a buffer position.
47	CVE-2020-14394	835	DoS	2022-08-17	2023-03-15	0.0	None	???	???	???	???	???	???
An infinite loop flaw was found in the USB xHCI controller emulation of QEMU while computing the length of the Transfer Request Block (TRB) Ring. This flaw allows a privileged guest user to hang the QEMU process on the host, resulting in a denial of service.
48	CVE-2020-13791	125		2020-06-04	2020-12-14	2.1	None	Local	Low	Not required	None	None	Partial
hw/pci/pci.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access by providing an address near the end of the PCI configuration space.
49	CVE-2020-13659	476		2020-06-02	2022-11-16	1.9	None	Local	Medium	Not required	None	None	Partial
address_space_map in exec.c in QEMU 4.2.0 can trigger a NULL pointer dereference related to BounceBuffer.
50	CVE-2020-13362	125		2020-05-28	2022-11-29	2.1	None	Local	Low	Not required	None	None	Partial
In QEMU 5.0.0 and earlier, megasas_lookup_frame in hw/scsi/megasas.c has an out-of-bounds read via a crafted reply_queue_head field from a guest OS user.

Total number of vulnerabilities : 182 Page : 1 (This Page)2 3 4