The esp_do_dma function in hw/scsi/esp.c in QEMU (aka Quick Emulator), when built with ESP/NCR53C9x controller emulation support, allows local guest OS administrators to cause a denial of service (out-of-bounds write and QEMU process crash) or execute arbitrary code on the QEMU host via vectors involving DMA read into ESP command buffer.
CVSS Details
- CVSS 3.1 Base Score: 6.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemuUpgrade qemu-kvm | Mar 31, 2017 | Jul 30, 2016 |
| Suse | — | Upgrade qemu-armUpgrade qemu-s390xUpgrade xen-develUpgrade qemu-block-rbdUpgrade xen-libsUpgrade qemu-ui-openglUpgrade xen-toolsUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-ui-spice-coreUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade xen-doc-pdfUpgrade qemu-ipxeUpgrade qemu-guest-agentUpgrade qemu-audio-ossUpgrade xen-kmp-paeUpgrade qemu-langUpgrade qemuUpgrade qemu-skibootUpgrade qemu-chardev-spiceUpgrade qemu-hw-display-virtio-gpu-pciUpgrade xen-libs-32bitUpgrade xen-kmp-defaultUpgrade qemu-block-iscsiUpgrade qemu-hw-display-virtio-gpuUpgrade xen-tools-xendomains-wait-diskUpgrade qemu-ui-spice-appUpgrade qemu-audio-spiceUpgrade qemu-seabiosUpgrade qemu-block-sshUpgrade qemu-ksmUpgrade qemu-hw-display-qxlUpgrade qemu-block-curlUpgrade qemu-chardev-baumUpgrade qemu-sgabiosUpgrade qemu-ui-cursesUpgrade qemu-ui-gtkUpgrade xen-kmp-traceUpgrade xen-doc-htmlUpgrade qemu-microvmUpgrade qemu-kvmUpgrade qemu-audio-alsaUpgrade qemu-s390Upgrade qemu-audio-paUpgrade qemu-ppcUpgrade qemu-x86Upgrade xenUpgrade qemu-toolsUpgrade qemu-vgabiosUpgrade qemu-hw-usb-redirectUpgrade xen-tools-domU | Sep 9, 2016 | Aug 17, 2016 |
| Ubuntu | — | Upgrade qemu-system-x86Upgrade qemu-kvmUpgrade qemu-system-sparcUpgrade qemu-system-armUpgrade qemu-system-aarch64Upgrade qemu-system-s390xUpgrade qemu-system-ppcUpgrade qemu-system-mipsUpgrade qemu-system-miscUpgrade qemu-system | Jul 1, 2017 | Aug 12, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub