The cpu_physical_memory_write_rom_internal function in exec.c in QEMU (aka Quick Emulator) does not properly skip MMIO regions, which allows local privileged guest users to cause a denial of service (guest crash) via unspecified vectors.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu | Jul 30, 2024 | Dec 29, 2016 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jan 27, 2016 |
| Suse | — | Upgrade xen-doc-htmlUpgrade qemu-seabiosUpgrade qemu-langUpgrade qemu-block-rbdUpgrade qemu-s390Upgrade qemuUpgrade xen-libs-32bitUpgrade xen-toolsUpgrade qemu-guest-agentUpgrade xen-kmp-paeUpgrade xen-kmp-defaultUpgrade xen-libsUpgrade qemu-ipxeUpgrade xen-tools-domUUpgrade xenUpgrade qemu-kvmUpgrade qemu-vgabiosUpgrade qemu-toolsUpgrade xen-develUpgrade qemu-ppcUpgrade qemu-sgabiosUpgrade qemu-x86Upgrade qemu-block-curl | Mar 28, 2016 | Mar 24, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub