CVE-2012-6075

qemu: e1000 driver buffer overflow when processing large packets when SBP and LPE flags are disabled

Buffer overflow in the e1000_receive function in the e1000 device driver (hw/e1000.c) in QEMU 1.3.0-rc2 and other versions, when the SBP and LPE flags are disabled, allows remote attackers to cause a denial of service (guest OS crash) and possibly execute arbitrary guest code via a large packet.

CVSS 2.0 · 9.3 Critical EPSS 4.9% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 4 more

Products

Ubuntu Linux Debian Linux Fedora and 12 more

CVE-2013-2007

qemu: guest agent creates files with insecure permissions in deamon mode

The qemu guest agent in Qemu 1.4.1 and earlier, as used by Xen, when started in daemon mode, uses weak permissions for certain files, which allows local users to read and write to these files.

CVSS 2.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Qemu Redhat

Products

Qemu Enterprise Linux

CVE-2013-4344

qemu: buffer overflow in scsi_target_emulate_report_luns

Buffer overflow in the SCSI implementation in QEMU, as used in Xen, when a SCSI controller has more than 256 attached devices, allows local users to gain privileges via a small transfer buffer in a REPORT LUNS command.

CVSS 2.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Canonical Opensuse Qemu and 1 more

Products

Ubuntu Linux Opensuse Qemu and 5 more

CVE-2021-4207

QEMU: QXL: double fetch in qxl_cursor() can lead to heap buffer overflow

A flaw was found in the QXL display device emulation in QEMU. A double fetch of guest controlled values `cursor->header.width` and `cursor->header.height` can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer overflow. A malicious privileged guest user could use this flaw to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU process.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Debian Qemu Redhat

Products

Debian Linux Qemu Advanced Virtualization and 1 more

CVE-2021-4206

QEMU: QXL: integer overflow in cursor_alloc() can lead to heap buffer overflow

A flaw was found in the QXL display device emulation in QEMU. An integer overflow in the cursor_alloc() function can lead to the allocation of a small cursor object followed by a subsequent heap-based buffer overflow. This flaw allows a malicious privileged guest user to crash the QEMU process on the host or potentially execute arbitrary code within the context of the QEMU process.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Debian Qemu Redhat

Products

Debian Linux Qemu Advanced Virtualization and 1 more

CVE-2021-3929

QEMU: nvme: DMA reentrancy issue leads to use-after-free

A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is similar to CVE-2021-3750 and, just like it, when the reentrancy write triggers the reset function nvme_ctrl_reset(), data structs will be freed leading to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition or, potentially, executing arbitrary code within the context of the QEMU process on the host.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Qemu

Products

Fedora Qemu

CVE-2021-3735

QEMU: ahci: deadlock issue leads to denial of service

A deadlock issue was found in the AHCI controller device of QEMU. It occurs on a software reset (ahci_reset_port) while handling a host-to-device Register FIS (Frame Information Structure) packet from the guest. A privileged user inside the guest could use this flaw to hang the QEMU process on the host, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Qemu

Products

Debian Linux Qemu

CVE-2023-0664

QEMU: local privilege escalation via the QEMU Guest Agent on Windows

A flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to manipulate the QEMU Guest Agent's Windows installer via repair custom actions to elevate their privileges on the system.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Microsoft Qemu and 1 more

Products

Fedora Windows Qemu and 1 more

CVE-2023-3354

Improper i/o watch removal in tls handshake can lead to remote unauthenticated denial of service

A flaw was found in the QEMU built-in VNC server. When a client connects to the VNC server, QEMU checks whether the current number of connections crosses a certain threshold and if so, cleans up the previous connection. If the previous connection happens to be in the handshake phase and fails, QEMU cleans up the connection again, resulting in a NULL pointer dereference issue. This could allow a remote unauthenticated client to cause a denial of service.

CVSS 3.1 · 7.5 High EPSS 1.6% KEV · Not listed

Vendors

Fedoraproject Qemu Redhat

Products

Fedora Qemu Advanced Virtualization and 7 more

CVE-2023-3301

Triggerable assertion due to race condition in hot-unplug

A flaw was found in QEMU. The async nature of hot-unplug enables a race scenario where the net device backend is cleared before the virtio-net pci frontend has been unplugged. A malicious guest could use this time window to trigger an assertion and cause a denial of service.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

Qemu Redhat

Products

Qemu Advanced Virtualization Enterprise Linux and 1 more

CVE-2023-2680

Dma reentrancy issue (incomplete fix for cve-2021-3750)

This CVE exists because of an incomplete fix for CVE-2021-3750. More specifically, the qemu-kvm package as released for Red Hat Enterprise Linux 9.1 via RHSA-2022:7967 included a version of qemu-kvm that was actually missing the fix for CVE-2021-3750.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Qemu Redhat

Products

Qemu Advanced Virtualization Enterprise Linux and 1 more

CVE-2023-4135

Out-of-bounds read information disclosure vulnerability

A heap out-of-bounds memory read flaw was found in the virtual nvme device in QEMU. The QEMU process does not validate an offset provided by the guest before computing a host heap pointer, which is used for copying data back to the guest. Arbitrary heap memory relative to an allocated buffer can be disclosed.

CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Qemu Redhat

Products

Fedora Qemu Advanced Virtualization and 1 more

CVE-2023-42467

QEMU: am53c974: denial of service due to division by zero

QEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset in hw/scsi/scsi-disk.c because scsi_disk_emulate_mode_select does not prevent s->qdev.blocksize from being 256. This stops QEMU and the guest immediately.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qemu Redhat

Products

Qemu Enterprise Linux

CVE-2023-40360

QEMU: NVMe: NULL pointer dereference in nvme_directive_receive()

QEMU through 8.0.4 accesses a NULL pointer in nvme_directive_receive in hw/nvme/ctrl.c because there is no check for whether an endurance group is configured before checking whether Flexible Data Placement is enabled.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qemu

Products

Qemu

CVE-2023-3180

Heap buffer overflow in virtio_crypto_sym_op_helper()

A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in virtio_crypto_handle_sym_req. There is no check for the value of `src_len` and `dst_len` in virtio_crypto_sym_op_helper, potentially leading to a heap buffer overflow when the two values differ.

CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Qemu and 1 more

Products

Debian Linux Fedora Qemu and 2 more

CVE-2023-2861

Qemu: 9pfs: improper access control on special files

A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. The 9pfs server did not prohibit opening special files on the host side, potentially allowing a malicious client to escape from the exported 9p tree by creating and opening a device file in the shared folder.

CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Qemu

Products

Qemu

CVE-2023-1386

Qemu: 9pfs: suid/sgid bits not dropped on file write

A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. When a local user in the guest writes an executable file with SUID or SGID, none of these privileged bits are correctly dropped. As a result, in rare circumstances, this flaw could be used by malicious users in the guest to elevate their privileges within the guest and help a host local user to elevate privileges on the host.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Qemu Redhat

Products

Fedora Qemu Advanced Virtualization and 1 more

CVE-2023-0330

Qemu: lsi53c895a: dma reentrancy issue leads to stack overflow

A vulnerability in the lsi53c895a device affects the latest version of qemu. A DMA-MMIO reentrancy problem may lead to memory corruption bugs like stack overflow or use-after-free.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Qemu

Products

Debian Linux Qemu

CVE-2022-36648

QEMU: rocker: NULL pointer dereference in of_dpa_cmd_add_l2_flood()

The hardware emulation in the of_dpa_cmd_add_l2_flood of rocker device model in QEMU, as used in 7.0.0 and earlier, allows remote attackers to crash the host qemu and potentially execute code on the host via execute a malformed program in the guest OS. Note: This has been disputed by multiple third parties as not a valid vulnerability due to the rocker device not falling within the virtualization use case.

CVSS 3.1 · 10.0 Critical EPSS 1.7% KEV · Not listed

Vendors

Qemu

Products

Qemu

CVE-2022-35414

QEMU: cputlb: uninitialized read during address translation leads to a crash

softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the translate_fail path, leading to an io_readx or io_writex crash. NOTE: a third party states that the Non-virtualization Use Case in the qemu.org reference applies here, i.e., "Bugs affecting the non-virtualization use case are not considered security bugs at this time.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Qemu

Products

Debian Linux Qemu