Integer signedness error in the virtio_net_load function in hw/net/virtio-net.c in QEMU 1.x before 1.7.2 allows remote attackers to execute arbitrary code via a crafted savevm image, which triggers a buffer overflow.
CVSS Details
- CVSS 3.1 Base Score: 8.4
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade qemu-guest-agentUpgrade libcacard-develUpgrade qemu-kvm-toolsUpgrade qemu-kvm-commonUpgrade libcacard-toolsUpgrade qemu-imgUpgrade qemu-kvmUpgrade libcacard | Dec 1, 2016 | Nov 4, 2014 |
| Debian | — | Upgrade qemu | Jul 30, 2024 | Nov 4, 2014 |
| Oracle_linux | — | Upgrade qemu-imgUpgrade libcacard-develUpgrade qemu-guest-agentUpgrade qemu-kvmUpgrade libcacard-toolsUpgrade qemu-kvm-toolsUpgrade libcacardUpgrade qemu-kvm-common | Oct 16, 2024 | Nov 4, 2014 |
| Suse | — | Upgrade kvm | Jun 26, 2014 | Jun 26, 2014 |
| Ubuntu | — | Upgrade qemu-system-armUpgrade qemu-kvmUpgrade qemu-system-aarch64Upgrade qemu-system-miscUpgrade qemu-system-mipsUpgrade qemu-system-x86Upgrade qemu-systemUpgrade qemu-system-sparcUpgrade qemu-system-ppc | Nov 8, 2024 | Nov 4, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub