QEMU (aka Quick Emulator) built with the USB EHCI emulation support is vulnerable to a null pointer dereference flaw. It could occur when an application attempts to write to EHCI capabilities registers. A privileged user inside quest could use this flaw to crash the QEMU process instance resulting in DoS.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu | Feb 20, 2019 | Dec 29, 2016 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Oct 30, 2017 | Dec 29, 2016 |
| Huawei Euleros 2_0_sp2 | — | Upgrade qemu-kvmUpgrade qemu-imgUpgrade qemu-kvm-common | Dec 4, 2019 | Dec 29, 2016 |
| Huawei Euleros 2_0_sp3 | — | Upgrade qemu-imgUpgrade qemu-kvm-commonUpgrade qemu-kvm | Apr 16, 2020 | Dec 29, 2016 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jan 29, 2016 |
| Suse | — | Upgrade xenUpgrade qemu-ppcUpgrade xen-kmp-defaultUpgrade xen-toolsUpgrade qemu-seabiosUpgrade qemu-s390Upgrade qemu-skibootUpgrade qemu-kvmUpgrade xen-kmp-paeUpgrade qemu-block-iscsiUpgrade qemu-audio-paUpgrade qemu-vgabiosUpgrade qemu-block-rbdUpgrade qemu-ui-gtkUpgrade qemu-hw-usb-redirectUpgrade qemu-microvmUpgrade qemu-chardev-baumUpgrade qemu-block-curlUpgrade qemu-audio-alsaUpgrade qemu-langUpgrade qemu-guest-agentUpgrade qemu-ksmUpgrade qemu-ui-spice-appUpgrade qemu-block-sshUpgrade qemu-ui-spice-coreUpgrade qemu-s390xUpgrade qemu-ui-cursesUpgrade kvmUpgrade xen-develUpgrade xen-tools-xendomains-wait-diskUpgrade qemu-audio-spiceUpgrade qemu-audio-ossUpgrade xen-doc-htmlUpgrade qemu-hw-display-virtio-gpu-pciUpgrade xen-tools-domuUpgrade qemu-ui-openglUpgrade qemu-x86Upgrade xen-libs-32bitUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-armUpgrade qemuUpgrade qemu-sgabiosUpgrade qemu-hw-display-qxlUpgrade qemu-toolsUpgrade qemu-chardev-spiceUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-ipxeUpgrade xen-libsUpgrade qemu-hw-display-virtio-vga | Mar 28, 2016 | Mar 24, 2016 |
| Ubuntu | — | Upgrade qemu-system-miscUpgrade qemu-system-armUpgrade qemu-kvmUpgrade qemu-system-aarch64Upgrade qemu-system-sparcUpgrade qemu-system-ppcUpgrade qemu-systemUpgrade qemu-system-x86Upgrade qemu-system-mips | Feb 3, 2016 | Feb 3, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub