Memory leak in the virgl_cmd_resource_unref function in hw/display/virtio-gpu-3d.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (host memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_UNREF commands sent without detaching the backing storage beforehand.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qemu | Aug 22, 2024 | Mar 16, 2017 |
| Debian | — | Upgrade qemu | Jul 30, 2024 | Mar 16, 2017 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Oct 30, 2017 | Mar 16, 2017 |
| Suse | — | Upgrade qemu-skibootUpgrade qemu-ksmUpgrade qemu-ui-spice-appUpgrade qemu-ui-gtkUpgrade qemu-ui-cursesUpgrade qemu-audio-alsaUpgrade qemu-s390Upgrade qemu-block-iscsiUpgrade qemu-seabiosUpgrade qemu-ui-spice-coreUpgrade qemu-ui-openglUpgrade qemu-block-curlUpgrade qemu-audio-ossUpgrade qemu-chardev-baumUpgrade qemu-ppcUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-hw-display-qxlUpgrade qemu-audio-paUpgrade qemu-toolsUpgrade qemu-audio-spiceUpgrade qemuUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-x86Upgrade qemu-vgabiosUpgrade qemu-hw-usb-redirectUpgrade qemu-sgabiosUpgrade qemu-block-rbdUpgrade qemu-block-sshUpgrade qemu-guest-agentUpgrade qemu-chardev-spiceUpgrade qemu-s390xUpgrade qemu-armUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-ipxeUpgrade qemu-microvmUpgrade qemu-kvmUpgrade qemu-lang | Mar 8, 2017 | Mar 7, 2017 |
| Ubuntu | — | Upgrade qemu-system-armUpgrade qemu-system-mipsUpgrade qemu-system-sparcUpgrade qemu-systemUpgrade qemu-system-aarch64Upgrade qemu-system-x86Upgrade qemu-system-s390xUpgrade qemu-system-ppcUpgrade qemu-system-misc | Apr 21, 2017 | Mar 7, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub