Memory leak in the megasas_handle_dcmd function in hw/scsi/megasas.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption) via MegaRAID Firmware Interface (MFI) commands with the sglist size set to a value over 2 Gb.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qemu | Aug 22, 2024 | Mar 16, 2017 |
| Debian | — | Upgrade qemu | Feb 19, 2019 | Mar 16, 2017 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Oct 30, 2017 | Mar 16, 2017 |
| Suse | — | Upgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-guest-agentUpgrade xenUpgrade qemu-audio-alsaUpgrade xen-kmp-paeUpgrade qemu-audio-paUpgrade qemu-ui-cursesUpgrade xen-tools-domUUpgrade qemu-chardev-baumUpgrade qemu-ksmUpgrade qemu-ppcUpgrade qemu-hw-usb-redirectUpgrade qemu-kvmUpgrade qemu-seabiosUpgrade qemu-x86Upgrade qemu-vgabiosUpgrade qemu-ui-gtkUpgrade qemu-block-iscsiUpgrade qemu-ui-spice-coreUpgrade qemu-microvmUpgrade qemu-langUpgrade qemu-s390Upgrade qemu-block-curlUpgrade qemu-s390xUpgrade qemuUpgrade xen-libs-32bitUpgrade qemu-block-sshUpgrade xen-libsUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-block-rbdUpgrade xen-kmp-defaultUpgrade xen-doc-htmlUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-sgabiosUpgrade xen-toolsUpgrade qemu-toolsUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-skibootUpgrade qemu-chardev-spiceUpgrade xen-develUpgrade qemu-ipxeUpgrade qemu-ui-openglUpgrade qemu-hw-display-qxlUpgrade kvmUpgrade qemu-audio-ossUpgrade qemu-audio-spiceUpgrade qemu-armUpgrade qemu-ui-spice-app | Feb 28, 2017 | Feb 27, 2017 |
| Ubuntu | — | Upgrade qemu-system-x86Upgrade qemu-systemUpgrade qemu-system-mipsUpgrade qemu-system-s390xUpgrade qemu-system-miscUpgrade qemu-system-aarch64Upgrade qemu-system-sparcUpgrade qemu-system-ppcUpgrade qemu-system-arm | Apr 21, 2017 | Feb 27, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub