CVE-2016-7423

Qemu: scsi: mptsas: OOB access when freeing MPTSASRequest object

The mptsas_process_scsi_io_request function in QEMU (aka Quick Emulator), when built with LSI SAS1068 Host Bus emulation support, allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) via vectors involving MPTSASRequest objects.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Qemu

Products

Qemu

CVE-2016-7466

Qemu: usb: xhci memory leakage during device unplug

Memory leak in the usb_xhci_exit function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator), when the xhci uses msix, allows local guest OS administrators to cause a denial of service (memory consumption and possibly QEMU process crash) by repeatedly unplugging a USB device.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed

Vendors

Opensuse Qemu Redhat

Products

Leap Qemu Enterprise Linux and 2 more

CVE-2016-7907

Qemu: net: inifinte loop in imx_fec_do_tx() function

The imx_fec_do_tx function in hw/net/imx_fec.c in QEMU (aka Quick Emulator) does not properly limit the buffer descriptor count when transmitting packets, which allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via vectors involving a buffer descriptor with a length of 0 and crafted values in bd.flags.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Qemu

Products

Qemu

CVE-2016-7908

Qemu: net: Infinite loop in mcf_fec_do_tx()

The mcf_fec_do_tx function in hw/net/mcf_fec.c in QEMU (aka Quick Emulator) does not properly limit the buffer descriptor count when transmitting packets, which allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) via vectors involving a buffer descriptor with a length of 0 and crafted values in bd.flags.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Qemu

Products

Debian Linux Qemu

CVE-2016-7909

Qemu: net: pcnet: infinite loop in pcnet_rdra_addr()

The pcnet_rdra_addr function in hw/net/pcnet.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by setting the (1) receive or (2) transmit descriptor ring length to 0.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Qemu

Products

Debian Linux Qemu

CVE-2016-7994

Qemu: virtio-gpu: memory leak in virtio_gpu_resource_create_2d

Memory leak in the virtio_gpu_resource_create_2d function in hw/display/virtio-gpu.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_CREATE_2D commands.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed

Vendors

Opensuse Qemu

Products

Leap Qemu

CVE-2016-7995

Qemu: usb: hcd-ehci: memory leak in ehci_process_itd

Memory leak in the ehci_process_itd function in hw/usb/hcd-ehci.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) via a large number of crafted buffer page select (PG) indexes.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed

Vendors

Opensuse Qemu

Products

Leap Qemu

CVE-2016-8576

Qemu: usb: xHCI: infinite loop vulnerability in xhci_ring_fetch

The xhci_ring_fetch function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by leveraging failure to limit the number of link Transfer Request Blocks (TRB) to process.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Opensuse Qemu and 1 more

Products

Debian Linux Leap Qemu and 3 more

CVE-2016-8577

Qemu: 9pfs: host memory leakage in v9fs_read

Memory leak in the v9fs_read function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) via vectors related to an I/O read operation.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Opensuse Qemu

Products

Debian Linux Leap Qemu

CVE-2013-4375

xen: qemu disk backend (qdisk) resource leak (XSA-71)

The qdisk PV disk backend in qemu-xen in Xen 4.2.x and 4.3.x before 4.3.1, and qemu 1.1 and other versions, allows local HVM guests to cause a denial of service (domain grant reference consumption) via unspecified vectors.

CVSS 2.0 · 2.7 Low EPSS < 1% KEV · Not listed

Vendors

Qemu Xen

Products

Qemu Xen

CVE-2013-4377

qemu: hot-unplugging virtio devices in guest can crash host qemu process

Use-after-free vulnerability in the virtio-pci implementation in Qemu 1.4.0 through 1.6.0 allows local users to cause a denial of service (daemon crash) by "hot-unplugging" a virtio device.

CVSS 2.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Qemu

Products

Qemu

CVE-2010-0297

kvm-userspace-rhel5: usb-linux.c: fix buffer overflow

Buffer overflow in the usb_host_handle_control function in the USB passthrough handling implementation in usb-linux.c in QEMU before 0.11.1 allows guest OS users to cause a denial of service (guest OS crash or hang) or possibly execute arbitrary code on the host OS via a crafted USB packet.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Qemu Redhat

Products

Qemu Enterprise Linux Rhel Virtualization

CVE-2010-0741

qemu: Improper handling of erroneous data provided by Linux virtio-net driver

The virtio_net_bad_features function in hw/virtio-net.c in the virtio-net driver in the Linux kernel before 2.6.26, when used on a guest OS in conjunction with qemu-kvm 0.11.0 or KVM 83, allows remote attackers to cause a denial of service (guest OS crash, and an associated qemu-kvm process exit) by sending a large amount of network traffic to a TCP port on the guest OS, related to a virtio-net whitelist that includes an improper implementation of TCP Segment Offloading (TSO).

CVSS 2.0 · 7.8 High EPSS 3.5% KEV · Not listed

Vendors

Kvm Qumranet Linux Qemu and 1 more

Products

Kvm Linux Kernel Qemu and 2 more

CVE-2011-0011

qemu-kvm: Setting VNC password to empty string silently disables all authentication

qemu-kvm before 0.11.0 disables VNC authentication when the password is cleared, which allows remote attackers to bypass authentication and establish VNC sessions.

CVSS 2.0 · 4.3 Medium EPSS 1.3% KEV · Not listed

Vendors

Qemu Redhat

Products

Qemu Enterprise Linux

CVE-2011-1750

virtio-blk: heap buffer overflow caused by unaligned requests

Multiple heap-based buffer overflows in the virtio-blk driver (hw/virtio-blk.c) in qemu-kvm 0.14.0 allow local guest users to cause a denial of service (guest crash) and possibly gain privileges via a (1) write request to the virtio_blk_handle_write function or (2) read request to the virtio_blk_handle_read function that is not properly aligned.

CVSS 2.0 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Qemu Redhat

Products

Qemu Enterprise Linux

CVE-2011-1751

qemu: acpi_piix4: missing hotplug check during device removal

The pciej_write function in hw/acpi_piix4.c in the PIIX4 Power Management emulation in qemu-kvm does not check if a device is hotpluggable before unplugging the PCI-ISA bridge, which allows privileged guest users to cause a denial of service (guest crash) and possibly execute arbitrary code by sending a crafted value to the 0xae08 (PCI_EJ_BASE) I/O port, which leads to a use-after-free related to "active qemu timers."

CVSS 2.0 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Qemu Redhat

Products

Qemu Enterprise Linux

CVE-2011-2212

qemu-kvm: virtqueue: too-large indirect descriptor buffer overflow

Buffer overflow in the virtio subsystem in qemu-kvm 0.14.0 and earlier allows privileged guest users to cause a denial of service (guest crash) or gain privileges via a crafted indirect descriptor related to "virtqueue in and out requests."

CVSS 2.0 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Qemu Redhat

Products

Qemu Enterprise Linux

CVE-2011-2527

qemu: when started as root, extra groups are not dropped correctly

The change_process_uid function in os-posix.c in Qemu 0.14.0 and earlier does not properly drop group privileges when the -runas option is used, which allows local guest users to access restricted files on the host.

CVSS 2.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Qemu Redhat

Products

Qemu Enterprise Linux

CVE-2012-2652

qemu: vulnerable to temporary file symlink attacks

The bdrv_open function in Qemu 1.0 does not properly handle the failure of the mkstemp function, when in snapshot node, which allows local users to overwrite or read arbitrary files via a symlink attack on an unspecified temporary file.

CVSS 2.0 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Qemu

Products

Qemu

CVE-2012-3515

qemu: VT100 emulation vulnerability

Qemu, as used in Xen 4.0, 4.1 and possibly other products, when emulating certain devices with a virtual console backend, allows local OS guest users to gain privileges via a crafted escape VT100 sequence that triggers the overwrite of a "device model's address space."

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Opensuse and 4 more

Products

Ubuntu Linux Debian Linux Opensuse and 12 more