Memory leak in the virtio_gpu_resource_create_2d function in hw/display/virtio-gpu.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_CREATE_2D commands.
CVSS Details
- CVSS 3.1 Base Score: 6
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qemu | Aug 22, 2024 | Dec 10, 2016 |
| Debian | — | Upgrade qemu | Jul 30, 2024 | Dec 10, 2016 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Oct 30, 2017 | Dec 9, 2016 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Sep 19, 2016 |
| Suse | — | Upgrade qemu-ui-gtkUpgrade qemuUpgrade qemu-hw-usb-redirectUpgrade qemu-ui-spice-coreUpgrade qemu-microvmUpgrade qemu-langUpgrade qemu-skibootUpgrade qemu-armUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-block-sshUpgrade qemu-audio-paUpgrade qemu-block-iscsiUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-ppcUpgrade qemu-hw-display-qxlUpgrade qemu-x86Upgrade qemu-vgabiosUpgrade qemu-block-curlUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-audio-alsaUpgrade qemu-guest-agentUpgrade qemu-toolsUpgrade qemu-audio-ossUpgrade qemu-ui-cursesUpgrade qemu-sgabiosUpgrade qemu-ipxeUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-chardev-spiceUpgrade qemu-audio-spiceUpgrade qemu-chardev-baumUpgrade qemu-s390Upgrade qemu-seabiosUpgrade qemu-ksmUpgrade qemu-ui-openglUpgrade qemu-s390xUpgrade qemu-ui-spice-appUpgrade qemu-kvmUpgrade qemu-block-rbd | Nov 23, 2016 | Nov 22, 2016 |
| Ubuntu | — | Upgrade qemu-system-sparcUpgrade qemu-system-miscUpgrade qemu-systemUpgrade qemu-system-mipsUpgrade qemu-system-aarch64Upgrade qemu-system-s390xUpgrade qemu-kvmUpgrade qemu-system-ppcUpgrade qemu-system-x86Upgrade qemu-system-arm | Nov 9, 2016 | Nov 9, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub