The virtio_net_load function in hw/net/virtio-net.c in QEMU 1.5.0 through 1.7.x before 1.7.2 allows remote attackers to cause a denial of service or possibly execute arbitrary code via vectors in which the value of curr_queues is greater than max_queues, which triggers an out-of-bounds write.
CVSS Details
- CVSS 3.1 Base Score: 9.8
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade qemu-kvm-commonUpgrade qemu-guest-agentUpgrade libcacardUpgrade libcacard-develUpgrade qemu-kvmUpgrade libcacard-toolsUpgrade qemu-kvm-toolsUpgrade qemu-img | Dec 1, 2016 | Nov 4, 2014 |
| Debian | — | Upgrade qemu | Jul 30, 2024 | Nov 4, 2014 |
| Oracle_linux | — | Upgrade libcacard-toolsUpgrade qemu-kvmUpgrade libcacardUpgrade qemu-guest-agentUpgrade qemu-kvm-toolsUpgrade qemu-kvm-commonUpgrade qemu-imgUpgrade libcacard-devel | Oct 16, 2024 | Nov 4, 2014 |
| Suse | — | Upgrade kvm | Jun 26, 2014 | Jun 26, 2014 |
| Ubuntu | — | Upgrade qemu-systemUpgrade qemu-system-mipsUpgrade qemu-system-sparcUpgrade qemu-system-miscUpgrade qemu-system-ppcUpgrade qemu-system-x86Upgrade qemu-system-aarch64Upgrade qemu-system-armUpgrade qemu-kvm | Nov 8, 2024 | Nov 4, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub