The process_tx_desc function in hw/net/e1000.c in QEMU before 2.4.0.1 does not properly process transmit descriptor data when sending a network packet, which allows attackers to cause a denial of service (infinite loop and guest crash) via unspecified vectors.
Max CVSS
3.5
EPSS Score
0.05%
Published
2020-01-31
Updated
2023-09-12
Quick Emulator (Qemu) built with the Virtio GPU Device emulator support is vulnerable to an information leakage issue. It could occur while processing 'VIRTIO_GPU_CMD_GET_CAPSET' command. A guest user/process could use this flaw to leak contents of the host memory bytes.
Max CVSS
3.3
EPSS Score
0.05%
Published
2016-12-23
Updated
2020-12-14
hw/ppc/spapr.c in QEMU through 3.1.0 allows Information Exposure because the hypervisor shares the /proc/device-tree/system-id and /proc/device-tree/model system attributes with a guest.
Max CVSS
3.3
EPSS Score
0.09%
Published
2019-03-21
Updated
2022-04-05
In QEMU 1:4.1-1, 1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8~deb10u1, 1:3.1+dfsg-8+deb10u2, and 1:2.1+dfsg-12+deb8u12 (fixed), when executing script in lsi_execute_script(), the LSI scsi adapter emulator advances 's->dsp' index to read next opcode. This can lead to an infinite loop if the next opcode is empty. Move the existing loop exit after 10k iterations so that it covers no-op opcodes as well.
Max CVSS
3.8
EPSS Score
0.05%
Published
2019-09-24
Updated
2020-07-26
QEMU 4.1.0 has a memory leak in zrle_compress_data in ui/vnc-enc-zrle.c during a VNC disconnect operation because libz is misused, resulting in a situation where memory allocated in deflateInit2 is not freed in deflateEnd.
Max CVSS
3.5
EPSS Score
0.05%
Published
2020-03-05
Updated
2023-01-24
An integer overflow was found in QEMU 4.0.1 through 4.2.0 in the way it implemented ATI VGA emulation. This flaw occurs in the ati_2d_blt() routine in hw/display/ati-2d.c while handling MMIO write operations through the ati_mm_write() callback. A malicious guest could abuse this flaw to crash the QEMU process, resulting in a denial of service.
Max CVSS
3.3
EPSS Score
0.05%
Published
2020-04-27
Updated
2020-05-28
iscsi_aio_ioctl_cb in block/iscsi.c in QEMU 4.1.0 has a heap-based buffer over-read that may disclose unrelated information from process memory to an attacker.
Max CVSS
3.8
EPSS Score
0.05%
Published
2020-12-31
Updated
2021-02-18
In QEMU through 5.0.0, an integer overflow was found in the SM501 display driver implementation. This flaw occurs in the COPY_AREA macro while handling MMIO write operations through the sm501_2d_engine_write() callback. A local attacker could abuse this flaw to crash the QEMU process in sm501_2d_operation() in hw/display/sm501.c on the host, resulting in a denial of service.
Max CVSS
3.8
EPSS Score
0.04%
Published
2020-08-31
Updated
2020-12-14
In QEMU 5.0.0 and earlier, es1370_transfer_audio in hw/audio/es1370.c does not properly validate the frame count, which allows guest OS users to trigger an out-of-bounds access during an es1370_write() operation.
Max CVSS
3.9
EPSS Score
0.05%
Published
2020-05-28
Updated
2022-11-29
In QEMU 5.0.0 and earlier, megasas_lookup_frame in hw/scsi/megasas.c has an out-of-bounds read via a crafted reply_queue_head field from a guest OS user.
Max CVSS
3.2
EPSS Score
0.05%
Published
2020-05-28
Updated
2022-11-29
An infinite loop flaw was found in the USB xHCI controller emulation of QEMU while computing the length of the Transfer Request Block (TRB) Ring. This flaw allows a privileged guest user to hang the QEMU process on the host, resulting in a denial of service.
Max CVSS
3.2
EPSS Score
0.05%
Published
2022-08-17
Updated
2023-03-15
oss_write in audio/ossaudio.c in QEMU before 5.0.0 mishandles a buffer position.
Max CVSS
3.3
EPSS Score
0.04%
Published
2020-08-27
Updated
2020-09-02
QEMU 4.2.0 has a use-after-free in hw/net/e1000e_core.c because a guest OS user can trigger an e1000e packet with the data's address set to the e1000e's MMIO address.
Max CVSS
3.3
EPSS Score
0.05%
Published
2020-07-21
Updated
2022-09-23
In QEMU through 5.0.0, an assertion failure can occur in the network packet processing. This issue affects the e1000e and vmxnet3 network devices. A malicious guest user/process could use this flaw to abort the QEMU process on the host, resulting in a denial of service condition in net_tx_pkt_add_raw_fragment in hw/net/net_tx_pkt.c.
Max CVSS
3.8
EPSS Score
0.05%
Published
2020-08-11
Updated
2022-09-30
QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not checked.
Max CVSS
3.2
EPSS Score
0.05%
Published
2020-09-25
Updated
2022-09-23
A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB requests due to missing handling of DMA memory map failure. A malicious privileged user within the guest may abuse this flaw to send bogus USB requests and crash the QEMU process on the host, resulting in a denial of service.
Max CVSS
3.2
EPSS Score
0.05%
Published
2020-12-02
Updated
2022-09-30
fdctrl_write_data in hw/block/fdc.c in QEMU 5.0.0 has a NULL pointer dereference via a NULL block pointer for the current drive.
Max CVSS
3.2
EPSS Score
0.05%
Published
2020-10-02
Updated
2020-10-14
pci_change_irq_level in hw/pci/pci.c in QEMU before 5.1.1 has a NULL pointer dereference because pci_get_bus() might not return a valid pointer.
Max CVSS
3.2
EPSS Score
0.05%
Published
2020-10-06
Updated
2020-10-07
hw/ide/pci.c in QEMU before 5.1.1 can trigger a NULL pointer dereference because it lacks a pointer check before an ide_cancel_dma_sync call.
Max CVSS
3.2
EPSS Score
0.05%
Published
2020-10-06
Updated
2020-10-07
ide_atapi_cmd_reply_end in hw/ide/atapi.c in QEMU 5.1.0 allows out-of-bounds read access because a buffer index is not validated.
Max CVSS
3.9
EPSS Score
0.05%
Published
2021-01-26
Updated
2022-09-30
A use-after-free flaw was found in the MegaRAID emulator of QEMU. This issue occurs while processing SCSI I/O requests in the case of an error mptsas_free_request() that does not dequeue the request object 'req' from a pending requests queue. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. Versions between 2.10.0 and 5.2.0 are potentially affected.
Max CVSS
3.2
EPSS Score
0.07%
Published
2021-03-23
Updated
2022-09-30
An integer overflow issue was found in the vmxnet3 NIC emulator of the QEMU for versions up to v5.2.0. It may occur if a guest was to supply invalid values for rx/tx queue size or other NIC parameters. A privileged guest user may use this flaw to crash the QEMU process on the host resulting in DoS scenario.
Max CVSS
3.2
EPSS Score
0.06%
Published
2021-02-25
Updated
2022-09-30
A flaw was found in the virtio-fs shared file system daemon (virtiofsd) of QEMU. The new 'xattrmap' option may cause the 'security.capability' xattr in the guest to not drop on file write, potentially leading to a modified, privileged executable in the guest. In rare circumstances, this flaw could be used by a malicious user to elevate their privileges within the guest.
Max CVSS
3.3
EPSS Score
0.05%
Published
2021-03-09
Updated
2022-09-30
A flaw was found in the vhost-vsock device of QEMU. In case of error, an invalid element was not detached from the virtqueue before freeing its memory, leading to memory leakage and other unexpected results. Affected QEMU versions <= 6.2.0.
Max CVSS
3.2
EPSS Score
0.05%
Published
2022-03-16
Updated
2023-02-12
24 vulnerabilities found
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!