CVE-2022-26354

QEMU: vhost-vsock: missing virtqueue detach on error can lead to memory leak

A flaw was found in the vhost-vsock device of QEMU. In case of error, an invalid element was not detached from the virtqueue before freeing its memory, leading to memory leakage and other unexpected results. Affected QEMU versions <= 6.2.0.

CVSS 3.1 · 3.2 Low EPSS < 1% KEV · Not listed

Vendors

Debian Qemu Redhat

Products

Debian Linux Qemu Advanced Virtualization and 1 more

CVE-2022-26353

QEMU: virtio-net: map leaking on error during receive

A flaw was found in the virtio-net device of QEMU. This flaw was inadvertently introduced with the fix for CVE-2021-3748, which forgot to unmap the cached virtqueue elements on error, leading to memory leakage and other unexpected results. Affected QEMU version: 6.2.0.

CVSS 3.1 · 7.5 High EPSS 2.7% KEV · Not listed

Vendors

Debian Qemu Redhat

Products

Debian Linux Qemu Advanced Virtualization and 1 more

CVE-2022-1050

QEMU: pvrdma: use-after-free issue in pvrdma_exec_cmd()

A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to execute HW commands when shared buffers are not yet allocated, potentially leading to a use-after-free condition.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Qemu

Products

Qemu

CVE-2022-0358

QEMU: virtiofsd: potential privilege escalation via CVE-2018-13405

A flaw was found in the QEMU virtio-fs shared file system daemon (virtiofsd) implementation. This flaw is strictly related to CVE-2018-13405. A local guest user can create files in the directories shared by virtio-fs with unintended group ownership in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of the group. This could allow a malicious unprivileged user inside the guest to gain access to resources accessible to the root group, potentially escalating their privileges within the guest. A malicious local user in the host might also leverage this unexpected executable file created by the guest to escalate their privileges on the host system.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Qemu Redhat

Products

Qemu Advanced Virtualization Enterprise Linux and 1 more

CVE-2022-0216

QEMU: use-after-free in lsi_do_msgout function in hw/scsi/lsi53c895a.c

A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of QEMU. The flaw occurs while processing repeated messages to cancel the current SCSI request via the lsi_do_msgout function. This flaw allows a malicious privileged user within the guest to crash the QEMU process on the host, resulting in a denial of service.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Qemu

Products

Fedora Qemu

CVE-2021-4158

QEMU: NULL pointer dereference in pci_write() in hw/acpi/pcihp.c

A NULL pointer dereference issue was found in the ACPI code of QEMU. A malicious, privileged user within the guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed

Vendors

Qemu Redhat

Products

Qemu Enterprise Linux

CVE-2021-4145

QEMU: NULL pointer dereference in mirror_wait_on_conflicts() in block/mirror.c

A NULL pointer dereference issue was found in the block mirror layer of QEMU in versions prior to 6.2.0. The `self` pointer is dereferenced in mirror_wait_on_conflicts() without ensuring that it's not NULL. A malicious unprivileged user within the guest could use this flaw to crash the QEMU process on the host when writing data reaches the threshold of mirroring node.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qemu Redhat

Products

Qemu Enterprise Linux

CVE-2021-3947

QEMU: NVMe: out-of-bounds memory read in nvme_changed_nslist

A stack-buffer-overflow was found in QEMU in the NVME component. The flaw lies in nvme_changed_nslist() where a malicious guest controlling certain input can read out of bounds memory. A malicious user could use this flaw leading to disclosure of sensitive information.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qemu

Products

Qemu

CVE-2021-3930

QEMU: off-by-one error in mode_sense_page() in hw/scsi/scsi-disk.c

An off-by-one error was found in the SCSI device emulation in QEMU. It could occur while processing MODE SELECT commands in mode_sense_page() if the 'page' argument was set to MODE_PAGE_ALLS (0x3f). A malicious guest could use this flaw to potentially crash QEMU, resulting in a denial of service condition.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Qemu Redhat

Products

Debian Linux Qemu Advanced Virtualization and 8 more

CVE-2021-3750

QEMU: hcd-ehci: DMA reentrancy issue leads to use-after-free

A DMA reentrancy issue was found in the USB EHCI controller emulation of QEMU. EHCI does not verify if the Buffer Pointer overlaps with its MMIO region when it transfers the USB packets. Crafted content may be written to the controller's registers and trigger undesirable actions (such as reset) while the device is still transferring packets. This can ultimately lead to a use-after-free issue. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition, or potentially execute arbitrary code within the context of the QEMU process on the host. This flaw affects QEMU versions before 7.0.0.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Qemu Redhat

Products

Qemu Enterprise Linux Rhel Eus

CVE-2021-3748

QEMU: virtio-net: heap use-after-free in virtio_net_receive_rcu

A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the descriptor's address belongs to the non direct access region, due to num_buffers being set after the virtqueue elem has been unmapped. A malicious guest could use this flaw to crash QEMU, resulting in a denial of service condition, or potentially execute code on the host with the privileges of the QEMU process.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Canonical Debian Fedoraproject and 2 more

Products

Ubuntu Linux Debian Linux Fedora and 4 more

CVE-2021-3713

QEMU: out-of-bounds write in UAS (USB Attached SCSI) device emulation

An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-bounds access to the UASDevice->data3 and UASDevice->status3 fields. A malicious guest user could use this flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the host.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Debian Qemu

Products

Debian Linux Qemu

CVE-2021-3682

QEMU: usbredir: free() call on invalid pointer in bufp_alloc()

A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs when dropping packets during a bulk transfer from a SPICE client due to the packet queue being full. A malicious SPICE client could use this flaw to make QEMU call free() with faked heap chunk metadata, resulting in a crash of QEMU or potential code execution with the privileges of the QEMU process on the host.

CVSS 3.1 · 8.5 High EPSS 2.9% KEV · Not listed

Vendors

Debian Qemu Redhat

Products

Debian Linux Qemu Advanced Virtualization and 1 more

CVE-2021-3638

QEMU: ati-vga: inconsistent check in ati_2d_blt() may lead to out-of-bounds write

An out-of-bounds memory access flaw was found in the ATI VGA device emulation of QEMU. This flaw occurs in the ati_2d_blt() routine while handling MMIO write operations when the guest provides invalid values for the destination display parameters. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Qemu

Products

Fedora Qemu

CVE-2021-3611

QEMU: intel-hda: segmentation fault due to stack overflow

A stack overflow vulnerability was found in the Intel HD Audio device (intel-hda) of QEMU. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition. The highest threat from this vulnerability is to system availability. This flaw affects QEMU versions prior to 7.0.0.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Qemu Redhat

Products

Qemu Enterprise Linux

CVE-2021-3608

QEMU: pvrdma: uninitialized memory unmap in pvrdma_ring_init()

A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions prior to 6.1.0. The issue occurs while handling a "PVRDMA_REG_DSRHIGH" write from the guest and may result in a crash of QEMU or cause undefined behavior due to the access of an uninitialized pointer. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Qemu

Products

Debian Linux Fedora Qemu

CVE-2021-3607

QEMU: pvrdma: unchecked malloc size due to integer overflow in init_dev_ring()

An integer overflow was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions prior to 6.1.0. The issue occurs while handling a "PVRDMA_REG_DSRHIGH" write from the guest due to improper input validation. This flaw allows a privileged guest user to make QEMU allocate a large amount of memory, resulting in a denial of service. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Fedoraproject Qemu

Products

Debian Linux Fedora Qemu

CVE-2021-3582

QEMU: pvrdma: unproperly mremap in pvrdma_map_to_pdir()

A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. The issue occurs while handling a "PVRDMA_CMD_CREATE_MR" command due to improper memory remapping (mremap). This flaw allows a malicious guest to crash the QEMU process on the host. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Qemu

Products

Debian Linux Qemu

CVE-2021-3546

QEMU: vhost-user-gpu: out-of-bounds write in virgl_cmd_get_capset()

An out-of-bounds write vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0. The flaw occurs while processing the 'VIRTIO_GPU_CMD_GET_CAPSET' command from the guest. It could allow a privileged guest user to crash the QEMU process on the host, resulting in a denial of service condition, or potential code execution with the privileges of the QEMU process.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Vendors

Debian Qemu

Products

Debian Linux Qemu

CVE-2021-3545

QEMU: vhost-user-gpu: information disclosure due to uninitialized memory read

An information disclosure vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0. The flaw exists in virgl_cmd_get_capset_info() in contrib/vhost-user-gpu/virgl.c and could occur due to the read of uninitialized memory. A malicious guest could exploit this issue to leak memory from the host.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Debian Qemu

Products

Debian Linux Qemu