Array index error in the virtio_load function in hw/virtio/virtio.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary code via a crafted savevm image.
CVSS Details
- CVSS 3.1 Base Score: 6.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade qemu-imgUpgrade qemu-kvm-toolsUpgrade libcacard-develUpgrade qemu-kvmUpgrade qemu-guest-agentUpgrade qemu-kvm-commonUpgrade libcacard-toolsUpgrade libcacard | Dec 1, 2016 | Nov 4, 2014 |
| Debian | — | Upgrade qemu | Jul 30, 2024 | Nov 4, 2014 |
| Oracle_linux | — | Upgrade qemu-kvmUpgrade qemu-imgUpgrade libcacard-develUpgrade qemu-kvm-toolsUpgrade libcacardUpgrade qemu-kvm-commonUpgrade qemu-guest-agentUpgrade libcacard-tools | Oct 16, 2024 | Nov 4, 2014 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Dec 3, 2013 |
| Suse | — | Upgrade kvm | Jun 26, 2014 | Jun 26, 2014 |
| Ubuntu | — | Upgrade qemu-system-sparcUpgrade qemu-system-armUpgrade qemu-kvmUpgrade qemu-system-aarch64Upgrade qemu-system-ppcUpgrade qemu-system-mipsUpgrade qemu-system-x86Upgrade qemu-system-miscUpgrade qemu-system | Nov 8, 2024 | Nov 4, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub