QEMU, when built with the Pseudo Random Number Generator (PRNG) back-end support, allows local guest OS users to cause a denial of service (process crash) via an entropy request, which triggers arbitrary stack based allocation and memory corruption.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu | Feb 20, 2019 | Apr 7, 2016 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Oct 30, 2017 | Apr 7, 2016 |
| Huawei Euleros 2_0_sp2 | — | Upgrade qemu-kvm-commonUpgrade qemu-imgUpgrade qemu-kvm | Dec 4, 2019 | Apr 7, 2016 |
| Huawei Euleros 2_0_sp3 | — | Upgrade qemu-imgUpgrade qemu-kvm-commonUpgrade qemu-kvm | Apr 16, 2020 | Apr 7, 2016 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jan 22, 2016 |
| Suse | — | Upgrade qemu-x86Upgrade qemu-ppcUpgrade qemu-toolsUpgrade qemu-block-rbdUpgrade qemuUpgrade qemu-sgabiosUpgrade qemu-ipxeUpgrade kvmUpgrade qemu-vgabiosUpgrade qemu-s390Upgrade qemu-seabiosUpgrade qemu-guest-agentUpgrade qemu-kvmUpgrade qemu-block-curlUpgrade qemu-lang | Jun 13, 2016 | Apr 7, 2016 |
| Ubuntu | — | Upgrade qemu-kvmUpgrade qemu-system-armUpgrade qemu-system-x86Upgrade qemu-system-miscUpgrade qemu-system-ppcUpgrade qemu-system-aarch64Upgrade qemu-system-s390xUpgrade qemu-systemUpgrade qemu-system-sparcUpgrade qemu-system-mips | May 12, 2016 | Apr 7, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub