Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 429

Export CSV
CVE-2018-7550

QEMU: i386: multiboot OOB access while loading kernel image

The load_multiboot function in hw/i386/multiboot.c in Quick Emulator (aka QEMU) allows local guest OS users to execute arbitrary code on the QEMU host via a mh_load_end_addr value greater than mh_bss_end_addr, which triggers an out-of-bounds read or write memory access.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Qemu and 1 more
Products
Ubuntu Linux Debian Linux Qemu and 8 more
CVE-2018-5683

Qemu: Out-of-bounds read in vga_draw_text routine

The vga_draw_text function in Qemu allows local OS guest privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) by leveraging improper memory address validation.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Qemu and 1 more
Products
Ubuntu Linux Debian Linux Qemu and 8 more
CVE-2018-20815

QEMU: device_tree: heap buffer overflow while loading device tree blob

In QEMU 3.1.0, load_device_tree in device_tree.c calls the deprecated load_image function, which has a buffer overflow risk.

CVSS 3.0 · 9.8 Critical EPSS 4.4% KEV · Not listed
Vendors
Qemu Redhat
Products
Qemu Enterprise Linux Openstack and 1 more
CVE-2018-20216

QEMU: pvrdma: infinite loop in pvrdma_qp_send/recv

QEMU can have an infinite loop in hw/rdma/vmw/pvrdma_dev_ring.c because return values are not checked (and -1 is mishandled).

CVSS 3.1 · 7.5 High EPSS 3.9% KEV · Not listed
Vendors
Canonical Qemu
Products
Ubuntu Linux Qemu
CVE-2018-20191

QEMU: pvrdma: uar_read leads to NULL dereference

hw/rdma/vmw/pvrdma_main.c in QEMU does not implement a read operation (such as uar_read by analogy to uar_write), which allows attackers to cause a denial of service (NULL pointer dereference).

CVSS 3.1 · 7.5 High EPSS 3.7% KEV · Not listed
Vendors
Canonical Fedoraproject Qemu
Products
Ubuntu Linux Fedora Qemu
CVE-2018-20125

QEMU: pvrdma: null dereference or excessive memory allocation when creating QP/CQ

hw/rdma/vmw/pvrdma_cmd.c in QEMU allows attackers to cause a denial of service (NULL pointer dereference or excessive memory allocation) in create_cq_ring or create_qp_rings.

CVSS 3.1 · 7.5 High EPSS 3.7% KEV · Not listed
Vendors
Canonical Qemu
Products
Ubuntu Linux Qemu
CVE-2018-20124

QEMU: rdma: OOB access when building scatter-gather array

hw/rdma/rdma_backend.c in QEMU allows guest OS users to trigger out-of-bounds access via a PvrdmaSqWqe ring element with a large num_sge value.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Qemu
Products
Ubuntu Linux Qemu
CVE-2018-19665

Qemu: bt: Integer overflow in Bluetooth routines allows memory corruption

The Bluetooth subsystem in QEMU mishandles negative values for length variables, leading to memory corruption.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed
Vendors
Opensuse Qemu
Products
Leap Qemu
CVE-2018-19364

Qemu: 9pfs: Use-after-free due to race condition while updating fid path

hw/9pfs/cofile.c and hw/9pfs/9p.c in QEMU can modify an fid path while it is being accessed by a second thread, leading to (for example) a use-after-free outcome.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 2 more
CVE-2018-18954

QEMU: ppc64: Out-of-bounds r/w stack access in pnv_lpc_do_eccb

The pnv_lpc_do_eccb function in hw/ppc/pnv_lpc.c in Qemu before 3.1 allows out-of-bounds write or read access to PowerNV memory.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Canonical Opensuse Qemu
Products
Ubuntu Linux Leap Qemu
CVE-2018-18438

Qemu: Integer overflow in ccid_card_vscard_read() allows memory corruption

Qemu has integer overflows because IOReadHandler and its associated functions use a signed integer data type for a size value.

CVSS 3.0 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Qemu Redhat
Products
Qemu Enterprise Linux Openstack
CVE-2018-17963

QEMU: net: ignore packets with large size

qemu_deliver_packet_iov in net/net.c in Qemu accepts packet sizes greater than INT_MAX, which allows attackers to cause a denial of service or possibly have unspecified other impact.

CVSS 3.1 · 9.8 Critical EPSS 4.7% KEV · Not listed
Vendors
Canonical Debian Qemu and 1 more
Products
Ubuntu Linux Debian Linux Qemu and 5 more
CVE-2018-16872

QEMU: usb-mtp: path traversal by host filesystem manipulation in Media Transfer Protocol (MTP)

A flaw was found in qemu Media Transfer Protocol (MTP). The code opening files in usb_mtp_get_object and usb_mtp_get_partial_object and directories in usb_mtp_object_readdir doesn't consider that the underlying filesystem may have changed since the time lstat(2) was called in usb_mtp_object_alloc, a classical TOCTTOU problem. An attacker with write access to the host filesystem shared with a guest can use this property to navigate the host filesystem in the context of the QEMU process and read any file the QEMU process has access to. Access to the filesystem may be local or via a network share protocol such as CIFS.

CVSS 3.1 · 5.3 Medium EPSS 1.1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 2 more
CVE-2018-16867

QEMU: dev-mtp: path traversal in usb_mtp_write_data of the Media Transfer Protocol (MTP)

A flaw was found in qemu Media Transfer Protocol (MTP) before version 3.1.0. A path traversal in the in usb_mtp_write_data function in hw/usb/dev-mtp.c due to an improper filename sanitization. When the guest device is mounted in read-write mode, this allows to read/write arbitrary files which may lead do DoS scenario OR possibly lead to code execution on the host.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Fedoraproject Qemu
Products
Ubuntu Linux Fedora Qemu
CVE-2018-16847

QEMU: nvme: Out-of-bounds r/w buffer access in cmb operations

An OOB heap buffer r/w access issue was found in the NVM Express Controller emulation in QEMU. It could occur in nvme_cmb_ops routines in nvme device. A guest user/process could use this flaw to crash the QEMU process resulting in DoS or potentially run arbitrary code with privileges of the QEMU process.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Canonical Qemu
Products
Ubuntu Linux Qemu