Memory leak in the virtio_gpu_resource_attach_backing function in hw/display/virtio-gpu.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (host memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_ATTACH_BACKING commands.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qemu | Aug 22, 2024 | Mar 15, 2017 |
| Debian | — | Upgrade qemu | Jul 30, 2024 | Mar 15, 2017 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Oct 30, 2017 | Mar 15, 2017 |
| Suse | — | Upgrade qemu-kvmUpgrade qemu-ppcUpgrade qemu-ui-gtkUpgrade qemu-x86Upgrade qemu-chardev-baumUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-microvmUpgrade qemu-ui-cursesUpgrade qemu-audio-paUpgrade qemu-block-curlUpgrade qemu-toolsUpgrade qemu-vgabiosUpgrade qemu-sgabiosUpgrade qemu-hw-usb-redirectUpgrade qemu-s390Upgrade qemu-s390xUpgrade qemu-audio-alsaUpgrade qemu-guest-agentUpgrade qemu-audio-spiceUpgrade qemu-langUpgrade qemu-seabiosUpgrade qemu-hw-display-qxlUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-block-rbdUpgrade qemu-ui-openglUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-block-sshUpgrade qemu-chardev-spiceUpgrade qemu-ui-spice-coreUpgrade qemuUpgrade qemu-block-iscsiUpgrade qemu-ksmUpgrade qemu-ipxeUpgrade qemu-ui-spice-appUpgrade qemu-armUpgrade qemu-skibootUpgrade qemu-audio-oss | Mar 8, 2017 | Mar 7, 2017 |
| Ubuntu | — | Upgrade qemu-system-aarch64Upgrade qemu-system-sparcUpgrade qemu-system-x86Upgrade qemu-system-mipsUpgrade qemu-systemUpgrade qemu-system-miscUpgrade qemu-system-ppcUpgrade qemu-system-s390xUpgrade qemu-system-arm | Apr 21, 2017 | Mar 7, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub