Use-after-free vulnerability in the vmxnet3_io_bar0_write function in hw/net/vmxnet3.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (QEMU instance crash) by leveraging failure to check if the device is active.
CVSS Details
- CVSS 3.1 Base Score: 4.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu | Feb 20, 2019 | Dec 9, 2016 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Oct 30, 2017 | Dec 9, 2016 |
| Suse | — | Upgrade xen-develUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-ui-cursesUpgrade qemu-ui-spice-coreUpgrade qemu-ui-openglUpgrade qemu-hw-display-qxlUpgrade qemu-audio-ossUpgrade qemu-block-iscsiUpgrade qemu-skibootUpgrade qemu-hw-usb-redirectUpgrade qemu-ppcUpgrade xen-tools-domUUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-toolsUpgrade qemu-x86Upgrade qemu-audio-paUpgrade qemu-microvmUpgrade qemu-armUpgrade qemu-guest-agentUpgrade qemuUpgrade xenUpgrade qemu-ipxeUpgrade qemu-s390Upgrade qemu-vgabiosUpgrade qemu-chardev-baumUpgrade qemu-chardev-spiceUpgrade qemu-block-curlUpgrade qemu-seabiosUpgrade qemu-langUpgrade xen-kmp-paeUpgrade xen-toolsUpgrade qemu-audio-spiceUpgrade qemu-sgabiosUpgrade qemu-block-rbdUpgrade qemu-kvmUpgrade qemu-ui-spice-appUpgrade xen-libs-32bitUpgrade qemu-ksmUpgrade qemu-ui-gtkUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-block-sshUpgrade xen-libsUpgrade qemu-audio-alsaUpgrade xen-doc-htmlUpgrade qemu-s390xUpgrade xen-kmp-default | Nov 3, 2016 | Oct 7, 2016 |
| Ubuntu | — | Upgrade qemu-system-s390xUpgrade qemu-kvmUpgrade qemu-system-miscUpgrade qemu-system-aarch64Upgrade qemu-system-armUpgrade qemu-system-x86Upgrade qemu-system-mipsUpgrade qemu-system-ppcUpgrade qemu-system-sparcUpgrade qemu-system | Nov 9, 2016 | Nov 9, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub