A flaw was found in the vhost-vsock device of QEMU. In case of error, an invalid element was not detached from the virtqueue before freeing its memory, leading to memory leakage and other unexpected results. Affected QEMU versions <= 6.2.0.
Source: Red Hat, Inc.
Max CVSS
3.2
EPSS Score
0.05%
Published
2022-03-16
Updated
2023-02-12
A flaw was found in the virtio-fs shared file system daemon (virtiofsd) of QEMU. The new 'xattrmap' option may cause the 'security.capability' xattr in the guest to not drop on file write, potentially leading to a modified, privileged executable in the guest. In rare circumstances, this flaw could be used by a malicious user to elevate their privileges within the guest.
Source: Red Hat, Inc.
Max CVSS
3.3
EPSS Score
0.05%
Published
2021-03-09
Updated
2022-09-30
An integer overflow issue was found in the vmxnet3 NIC emulator of the QEMU for versions up to v5.2.0. It may occur if a guest was to supply invalid values for rx/tx queue size or other NIC parameters. A privileged guest user may use this flaw to crash the QEMU process on the host resulting in DoS scenario.
Source: Red Hat, Inc.
Max CVSS
3.2
EPSS Score
0.06%
Published
2021-02-25
Updated
2022-09-30
A use-after-free flaw was found in the MegaRAID emulator of QEMU. This issue occurs while processing SCSI I/O requests in the case of an error mptsas_free_request() that does not dequeue the request object 'req' from a pending requests queue. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. Versions between 2.10.0 and 5.2.0 are potentially affected.
Source: Red Hat, Inc.
Max CVSS
3.2
EPSS Score
0.07%
Published
2021-03-23
Updated
2022-09-30
ide_atapi_cmd_reply_end in hw/ide/atapi.c in QEMU 5.1.0 allows out-of-bounds read access because a buffer index is not validated.
Source: MITRE
Max CVSS
3.9
EPSS Score
0.05%
Published
2021-01-26
Updated
2022-09-30
hw/ide/pci.c in QEMU before 5.1.1 can trigger a NULL pointer dereference because it lacks a pointer check before an ide_cancel_dma_sync call.
Source: MITRE
Max CVSS
3.2
EPSS Score
0.05%
Published
2020-10-06
Updated
2020-10-07
pci_change_irq_level in hw/pci/pci.c in QEMU before 5.1.1 has a NULL pointer dereference because pci_get_bus() might not return a valid pointer.
Source: MITRE
Max CVSS
3.2
EPSS Score
0.05%
Published
2020-10-06
Updated
2020-10-07
fdctrl_write_data in hw/block/fdc.c in QEMU 5.0.0 has a NULL pointer dereference via a NULL block pointer for the current drive.
Source: MITRE
Max CVSS
3.2
EPSS Score
0.05%
Published
2020-10-02
Updated
2020-10-14
A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB requests due to missing handling of DMA memory map failure. A malicious privileged user within the guest may abuse this flaw to send bogus USB requests and crash the QEMU process on the host, resulting in a denial of service.
Source: Red Hat, Inc.
Max CVSS
3.2
EPSS Score
0.05%
Published
2020-12-02
Updated
2022-09-30
QEMU 5.0.0 has a use-after-free in hw/usb/hcd-xhci.c because the usb_packet_map return value is not checked.
Source: MITRE
Max CVSS
3.2
EPSS Score
0.05%
Published
2020-09-25
Updated
2022-09-23
In QEMU through 5.0.0, an assertion failure can occur in the network packet processing. This issue affects the e1000e and vmxnet3 network devices. A malicious guest user/process could use this flaw to abort the QEMU process on the host, resulting in a denial of service condition in net_tx_pkt_add_raw_fragment in hw/net/net_tx_pkt.c.
Source: MITRE
Max CVSS
3.8
EPSS Score
0.05%
Published
2020-08-11
Updated
2022-09-30
QEMU 4.2.0 has a use-after-free in hw/net/e1000e_core.c because a guest OS user can trigger an e1000e packet with the data's address set to the e1000e's MMIO address.
Source: MITRE
Max CVSS
3.3
EPSS Score
0.05%
Published
2020-07-21
Updated
2022-09-23
oss_write in audio/ossaudio.c in QEMU before 5.0.0 mishandles a buffer position.
Source: MITRE
Max CVSS
3.3
EPSS Score
0.04%
Published
2020-08-27
Updated
2020-09-02
An infinite loop flaw was found in the USB xHCI controller emulation of QEMU while computing the length of the Transfer Request Block (TRB) Ring. This flaw allows a privileged guest user to hang the QEMU process on the host, resulting in a denial of service.
Source: Red Hat, Inc.
Max CVSS
3.2
EPSS Score
0.05%
Published
2022-08-17
Updated
2023-03-15
In QEMU 5.0.0 and earlier, megasas_lookup_frame in hw/scsi/megasas.c has an out-of-bounds read via a crafted reply_queue_head field from a guest OS user.
Source: MITRE
Max CVSS
3.2
EPSS Score
0.05%
Published
2020-05-28
Updated
2022-11-29
In QEMU 5.0.0 and earlier, es1370_transfer_audio in hw/audio/es1370.c does not properly validate the frame count, which allows guest OS users to trigger an out-of-bounds access during an es1370_write() operation.
Source: MITRE
Max CVSS
3.9
EPSS Score
0.05%
Published
2020-05-28
Updated
2022-11-29
In QEMU through 5.0.0, an integer overflow was found in the SM501 display driver implementation. This flaw occurs in the COPY_AREA macro while handling MMIO write operations through the sm501_2d_engine_write() callback. A local attacker could abuse this flaw to crash the QEMU process in sm501_2d_operation() in hw/display/sm501.c on the host, resulting in a denial of service.
Source: MITRE
Max CVSS
3.8
EPSS Score
0.04%
Published
2020-08-31
Updated
2020-12-14
iscsi_aio_ioctl_cb in block/iscsi.c in QEMU 4.1.0 has a heap-based buffer over-read that may disclose unrelated information from process memory to an attacker.
Source: MITRE
Max CVSS
3.8
EPSS Score
0.05%
Published
2020-12-31
Updated
2021-02-18
An integer overflow was found in QEMU 4.0.1 through 4.2.0 in the way it implemented ATI VGA emulation. This flaw occurs in the ati_2d_blt() routine in hw/display/ati-2d.c while handling MMIO write operations through the ati_mm_write() callback. A malicious guest could abuse this flaw to crash the QEMU process, resulting in a denial of service.
Source: MITRE
Max CVSS
3.3
EPSS Score
0.05%
Published
2020-04-27
Updated
2020-05-28
QEMU 4.1.0 has a memory leak in zrle_compress_data in ui/vnc-enc-zrle.c during a VNC disconnect operation because libz is misused, resulting in a situation where memory allocated in deflateInit2 is not freed in deflateEnd.
Source: MITRE
Max CVSS
3.5
EPSS Score
0.05%
Published
2020-03-05
Updated
2023-01-24
In QEMU 1:4.1-1, 1:2.1+dfsg-12+deb8u6, 1:2.8+dfsg-6+deb9u8, 1:3.1+dfsg-8~deb10u1, 1:3.1+dfsg-8+deb10u2, and 1:2.1+dfsg-12+deb8u12 (fixed), when executing script in lsi_execute_script(), the LSI scsi adapter emulator advances 's->dsp' index to read next opcode. This can lead to an infinite loop if the next opcode is empty. Move the existing loop exit after 10k iterations so that it covers no-op opcodes as well.
Source: MITRE
Max CVSS
3.8
EPSS Score
0.05%
Published
2019-09-24
Updated
2020-07-26
hw/ppc/spapr.c in QEMU through 3.1.0 allows Information Exposure because the hypervisor shares the /proc/device-tree/system-id and /proc/device-tree/model system attributes with a guest.
Source: MITRE
Max CVSS
3.3
EPSS Score
0.09%
Published
2019-03-21
Updated
2022-04-05
Quick Emulator (Qemu) built with the Virtio GPU Device emulator support is vulnerable to an information leakage issue. It could occur while processing 'VIRTIO_GPU_CMD_GET_CAPSET' command. A guest user/process could use this flaw to leak contents of the host memory bytes.
Source: Red Hat, Inc.
Max CVSS
3.3
EPSS Score
0.05%
Published
2016-12-23
Updated
2020-12-14
The process_tx_desc function in hw/net/e1000.c in QEMU before 2.4.0.1 does not properly process transmit descriptor data when sending a network packet, which allows attackers to cause a denial of service (infinite loop and guest crash) via unspecified vectors.
Source: Red Hat, Inc.
Max CVSS
3.5
EPSS Score
0.05%
Published
2020-01-31
Updated
2023-09-12
24 vulnerabilities found
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!