Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 110

Export CSV
CVE-2023-3180

Heap buffer overflow in virtio_crypto_sym_op_helper()

A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in virtio_crypto_handle_sym_req. There is no check for the value of `src_len` and `dst_len` in virtio_crypto_sym_op_helper, potentially leading to a heap buffer overflow when the two values differ.

CVSS 3.1 · 6 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Qemu and 1 more
Products
Debian Linux Fedora Qemu and 2 more
CVE-2023-1386

Qemu: 9pfs: suid/sgid bits not dropped on file write

A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. When a local user in the guest writes an executable file with SUID or SGID, none of these privileged bits are correctly dropped. As a result, in rare circumstances, this flaw could be used by malicious users in the guest to elevate their privileges within the guest and help a host local user to elevate privileges on the host.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed
Vendors
Fedoraproject Qemu Redhat
Products
Fedora Qemu Advanced Virtualization and 1 more
CVE-2022-26354

QEMU: vhost-vsock: missing virtqueue detach on error can lead to memory leak

A flaw was found in the vhost-vsock device of QEMU. In case of error, an invalid element was not detached from the virtqueue before freeing its memory, leading to memory leakage and other unexpected results. Affected QEMU versions <= 6.2.0.

CVSS 3.1 · 3.2 Low EPSS < 1% KEV · Not listed
Vendors
Debian Qemu Redhat
Products
Debian Linux Qemu Advanced Virtualization and 1 more
CVE-2022-26353

QEMU: virtio-net: map leaking on error during receive

A flaw was found in the virtio-net device of QEMU. This flaw was inadvertently introduced with the fix for CVE-2021-3748, which forgot to unmap the cached virtqueue elements on error, leading to memory leakage and other unexpected results. Affected QEMU version: 6.2.0.

CVSS 3.1 · 7.5 High EPSS 2.7% KEV · Not listed
Vendors
Debian Qemu Redhat
Products
Debian Linux Qemu Advanced Virtualization and 1 more
CVE-2022-0485

libnbd: nbdcopy: missing error handling may create corrupted destination image

A flaw was found in the copying tool `nbdcopy` of libnbd. When performing multi-threaded copies using asynchronous nbd calls, nbdcopy was blindly treating the completion of an asynchronous command as successful, rather than checking the *error parameter. This could result in the silent creation of a corrupted destination image.

CVSS 3.1 · 4.8 Medium EPSS 1.0% KEV · Not listed
Vendors
Redhat
Products
Advanced Virtualization Enterprise Linux Libnbd
CVE-2022-0358

QEMU: virtiofsd: potential privilege escalation via CVE-2018-13405

A flaw was found in the QEMU virtio-fs shared file system daemon (virtiofsd) implementation. This flaw is strictly related to CVE-2018-13405. A local guest user can create files in the directories shared by virtio-fs with unintended group ownership in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of the group. This could allow a malicious unprivileged user inside the guest to gain access to resources accessible to the root group, potentially escalating their privileges within the guest. A malicious local user in the host might also leverage this unexpected executable file created by the guest to escalate their privileges on the host system.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed
Vendors
Qemu Redhat
Products
Qemu Advanced Virtualization Enterprise Linux and 1 more
CVE-2021-3975

libvirt: segmentation fault during VM shutdown can lead to vdsm hang

A use-after-free flaw was found in libvirt. The qemuMonitorUnregister() function in qemuProcessHandleMonitorEOF is called using multiple threads without being adequately protected by a monitor lock. This flaw could be triggered by the virConnectGetAllDomainStats API when the guest is shutting down. An unprivileged client with a read-only connection could use this flaw to perform a denial of service attack by causing the libvirt daemon to crash.

CVSS 3.1 · 6.5 Medium EPSS 1.7% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 12 more
CVE-2021-3930

QEMU: off-by-one error in mode_sense_page() in hw/scsi/scsi-disk.c

An off-by-one error was found in the SCSI device emulation in QEMU. It could occur while processing MODE SELECT commands in mode_sense_page() if the 'page' argument was set to MODE_PAGE_ALLS (0x3f). A malicious guest could use this flaw to potentially crash QEMU, resulting in a denial of service condition.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Qemu Redhat
Products
Debian Linux Qemu Advanced Virtualization and 8 more
CVE-2021-3748

QEMU: virtio-net: heap use-after-free in virtio_net_receive_rcu

A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the descriptor's address belongs to the non direct access region, due to num_buffers being set after the virtqueue elem has been unmapped. A malicious guest could use this flaw to crash QEMU, resulting in a denial of service condition, or potentially execute code on the host with the privileges of the QEMU process.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Canonical Debian Fedoraproject and 2 more
Products
Ubuntu Linux Debian Linux Fedora and 4 more
CVE-2021-3716

nbdkit: NBD_OPT_STRUCTURED_REPLY injection on STARTTLS

A flaw was found in nbdkit due to to improperly caching plaintext state across the STARTTLS encryption boundary. A MitM attacker could use this flaw to inject a plaintext NBD_OPT_STRUCTURED_REPLY before proxying everything else a client sends to the server, potentially leading the client to terminate the NBD session. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Vendors
Nbdkit Project Redhat
Products
Nbdkit Advanced Virtualization Enterprise Linux
CVE-2021-3682

QEMU: usbredir: free() call on invalid pointer in bufp_alloc()

A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs when dropping packets during a bulk transfer from a SPICE client due to the packet queue being full. A malicious SPICE client could use this flaw to make QEMU call free() with faked heap chunk metadata, resulting in a crash of QEMU or potential code execution with the privileges of the QEMU process on the host.

CVSS 3.1 · 8.5 High EPSS 2.9% KEV · Not listed
Vendors
Debian Qemu Redhat
Products
Debian Linux Qemu Advanced Virtualization and 1 more
CVE-2021-3631

libvirt: Insecure sVirt label generation

A flaw was found in libvirt while it generates SELinux MCS category pairs for VMs' dynamic labels. This flaw allows one exploited guest to access files labeled for another guest, resulting in the breaking out of sVirt confinement. The highest threat from this vulnerability is to confidentiality and integrity.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed
Vendors
Netapp Redhat
Products
Ontap Select Deploy Administration Utility Advanced Virtualization Enterprise Linux and 2 more
CVE-2021-3416

QEMU: net: Infinite loop in loopback mode may lead to stack overflow

A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions up to and including 5.2.0. The issue occurs in loopback mode of a NIC wherein reentrant DMA checks get bypassed. A guest user/process may use this flaw to consume CPU cycles or crash the QEMU process on the host resulting in DoS scenario.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Qemu and 1 more
Products
Debian Linux Fedora Qemu and 2 more
CVE-2021-39257

ntfs-3g: Endless recursion from ntfs_attr_pwrite() triggered by an unallocated bitmap

A crafted NTFS image with an unallocated bitmap can lead to a endless recursive function call chain (starting from ntfs_attr_pwrite), causing stack consumption in NTFS-3G < 2021.8.22.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Redhat Tuxera
Products
Debian Linux Advanced Virtualization Enterprise Linux and 1 more
CVE-2021-20257

QEMU: net: e1000: infinite loop while processing transmit descriptors

An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx) descriptors in process_tx_desc if various descriptor fields are initialized with invalid values. This flaw allows a guest to consume CPU cycles on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Fedoraproject Qemu and 1 more
Products
Debian Linux Fedora Qemu and 6 more
CVE-2021-20221

qemu: out-of-bound heap buffer access via an interrupt ID field

An out-of-bounds heap buffer access issue was found in the ARM Generic Interrupt Controller emulator of QEMU up to and including qemu 4.2.0on aarch64 platform. The issue occurs because while writing an interrupt ID to the controller memory area, it is not masked to be 4 bits wide. It may lead to the said issue while updating controller state fields and their subsequent processing. A privileged guest user may use this flaw to crash the QEMU process on the host resulting in DoS scenario.

CVSS 3.1 · 6.0 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Qemu Redhat
Products
Debian Linux Qemu Advanced Virtualization and 1 more
CVE-2021-20196

QEMU: block: fdc: null pointer dereference may lead to guest crash

A NULL pointer dereference flaw was found in the floppy disk emulator of QEMU. This issue occurs while processing read/write ioport commands if the selected floppy drive is not initialized with a block device. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Debian Qemu Redhat
Products
Debian Linux Qemu Advanced Virtualization and 1 more
CVE-2020-8608

QEMU: Slirp: potential OOB access due to unsafe snprintf() usages

In libslirp 4.1.0, as used in QEMU 4.2.0, tcp_subr.c misuses snprintf return values, leading to a buffer overflow in later code.

CVSS 3.1 · 5.6 Medium EPSS 2.5% KEV · Not listed
Vendors
Debian Libslirp Project Opensuse and 1 more
Products
Debian Linux Libslirp Leap and 8 more
CVE-2020-7039

QEMU: slirp: OOB buffer access while emulating tcp protocols in tcp_emu()

tcp_emu in tcp_subr.c in libslirp 4.1.0, as used in QEMU 4.2.0, mismanages memory, as demonstrated by IRC DCC commands in EMU_IRC. This can cause a heap-based buffer overflow or other out-of-bounds access which can lead to a DoS or potential execute arbitrary code.

CVSS 3.1 · 5.6 Medium EPSS 3.6% KEV · Not listed
Vendors
Debian Libslirp Project Opensuse and 2 more
Products
Debian Linux Libslirp Leap and 9 more