Heap-based buffer overflow in the virtio_load function in hw/virtio/virtio.c in QEMU before 1.7.2 might allow remote attackers to execute arbitrary code via a crafted config length in a savevm image.
CVSS Details
- CVSS 3.1 Base Score: 8.4
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade libcacardUpgrade qemu-kvm-commonUpgrade qemu-kvmUpgrade libcacard-toolsUpgrade libcacard-develUpgrade qemu-guest-agentUpgrade qemu-kvm-toolsUpgrade qemu-img | Dec 1, 2016 | Nov 4, 2014 |
| Debian | — | Upgrade qemu | Jul 30, 2024 | Nov 4, 2014 |
| Oracle_linux | — | Upgrade qemu-kvm-commonUpgrade qemu-guest-agentUpgrade libcacardUpgrade libcacard-toolsUpgrade qemu-kvm-toolsUpgrade qemu-imgUpgrade qemu-kvmUpgrade libcacard-devel | Oct 16, 2024 | Nov 4, 2014 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 17, 2014 |
| Suse | — | Upgrade qemu-armUpgrade qemu-ppcUpgrade qemu-block-rbdUpgrade qemuUpgrade qemu-block-sshUpgrade qemu-block-curlUpgrade qemu-block-iscsiUpgrade qemu-toolsUpgrade qemu-langUpgrade qemu-guest-agentUpgrade qemu-vgabiosUpgrade qemu-kvmUpgrade qemu-s390Upgrade qemu-sgabiosUpgrade qemu-x86Upgrade qemu-ksmUpgrade qemu-ipxeUpgrade qemu-seabiosUpgrade kvm | Dec 18, 2015 | Nov 4, 2014 |
| Ubuntu | — | Upgrade qemu-systemUpgrade qemu-system-mipsUpgrade qemu-system-sparcUpgrade qemu-system-ppcUpgrade qemu-system-x86Upgrade qemu-system-armUpgrade qemu-kvmUpgrade qemu-system-miscUpgrade qemu-system-aarch64 | Nov 8, 2024 | Nov 4, 2014 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub