QEMU, when built with the Pseudo Random Number Generator (PRNG) back-end support, allows local guest OS users to cause a denial of service (process crash) via an entropy request, which triggers arbitrary stack based allocation and memory corruption.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu | Feb 20, 2019 | Apr 7, 2016 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Oct 30, 2017 | Apr 7, 2016 |
| Huawei Euleros 2_0_sp2 | — | Upgrade qemu-imgUpgrade qemu-kvmUpgrade qemu-kvm-common | Dec 4, 2019 | Apr 7, 2016 |
| Huawei Euleros 2_0_sp3 | — | Upgrade qemu-imgUpgrade qemu-kvm-commonUpgrade qemu-kvm | Apr 16, 2020 | Apr 7, 2016 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jan 22, 2016 |
| Suse | — | Upgrade qemu-seabiosUpgrade qemu-langUpgrade qemu-s390Upgrade qemu-vgabiosUpgrade qemu-kvmUpgrade qemu-guest-agentUpgrade qemu-block-curlUpgrade qemuUpgrade kvmUpgrade qemu-x86Upgrade qemu-toolsUpgrade qemu-sgabiosUpgrade qemu-block-rbdUpgrade qemu-ipxeUpgrade qemu-ppc | Jun 13, 2016 | Apr 7, 2016 |
| Ubuntu | — | Upgrade qemu-system-miscUpgrade qemu-system-ppcUpgrade qemu-system-aarch64Upgrade qemu-system-s390xUpgrade qemu-systemUpgrade qemu-system-x86Upgrade qemu-system-mipsUpgrade qemu-system-sparcUpgrade qemu-kvmUpgrade qemu-system-arm | May 12, 2016 | Apr 7, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub