Heap-based buffer overflow in the virtio_load function in hw/virtio/virtio.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted config length in a savevm image.
CVSS Details
- CVSS 3.1 Base Score: 8.4
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade libcacardUpgrade libcacard-toolsUpgrade qemu-kvmUpgrade qemu-kvm-commonUpgrade qemu-kvm-toolsUpgrade qemu-imgUpgrade qemu-guest-agentUpgrade libcacard-devel | Dec 1, 2016 | Nov 4, 2014 |
| Debian | — | Upgrade qemu | Jul 30, 2024 | Nov 4, 2014 |
| Oracle_linux | — | Upgrade libcacardUpgrade qemu-guest-agentUpgrade libcacard-toolsUpgrade qemu-kvm-commonUpgrade qemu-imgUpgrade libcacard-develUpgrade qemu-kvm-toolsUpgrade qemu-kvm | Oct 16, 2024 | Nov 4, 2014 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 17, 2014 |
| Suse | — | Upgrade qemu-x86Upgrade qemu-kvmUpgrade qemu-s390Upgrade qemu-ksmUpgrade qemu-seabiosUpgrade qemu-sgabiosUpgrade qemu-ipxeUpgrade kvmUpgrade qemu-vgabiosUpgrade qemu-armUpgrade qemu-guest-agentUpgrade qemu-toolsUpgrade qemu-block-curlUpgrade qemu-block-rbdUpgrade qemu-block-sshUpgrade qemu-block-iscsiUpgrade qemu-ppcUpgrade qemuUpgrade qemu-lang | Dec 18, 2015 | Nov 4, 2014 |
| Ubuntu | — | Upgrade qemu-system-aarch64Upgrade qemu-system-armUpgrade qemu-system-miscUpgrade qemu-kvmUpgrade qemu-systemUpgrade qemu-system-mipsUpgrade qemu-system-x86Upgrade qemu-system-ppcUpgrade qemu-system-sparc | Nov 8, 2024 | Nov 4, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub