The pvscsi_convert_sglist function in hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by leveraging an incorrect cast.
CVSS Details
- CVSS 3.1 Base Score: 4.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu | Feb 20, 2019 | Dec 9, 2016 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Oct 30, 2017 | Dec 9, 2016 |
| Suse | — | Upgrade qemu-chardev-spiceUpgrade qemu-block-sshUpgrade qemu-langUpgrade qemu-ui-spice-coreUpgrade qemu-sgabiosUpgrade qemu-audio-alsaUpgrade qemu-guest-agentUpgrade qemu-audio-spiceUpgrade qemu-chardev-baumUpgrade qemuUpgrade qemu-ui-gtkUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-kvmUpgrade qemu-block-rbdUpgrade qemu-block-curlUpgrade qemu-ppcUpgrade qemu-ipxeUpgrade qemu-toolsUpgrade qemu-vgabiosUpgrade qemu-s390Upgrade qemu-s390xUpgrade qemu-hw-display-qxlUpgrade qemu-ui-openglUpgrade qemu-ksmUpgrade qemu-x86Upgrade qemu-audio-paUpgrade qemu-microvmUpgrade qemu-skibootUpgrade qemu-audio-ossUpgrade qemu-seabiosUpgrade qemu-ui-spice-appUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-hw-usb-redirectUpgrade qemu-armUpgrade qemu-ui-cursesUpgrade qemu-block-iscsi | Nov 3, 2016 | Oct 21, 2016 |
| Ubuntu | — | Upgrade qemu-system-aarch64Upgrade qemu-system-sparcUpgrade qemu-system-mipsUpgrade qemu-system-s390xUpgrade qemu-system-miscUpgrade qemu-systemUpgrade qemu-system-ppcUpgrade qemu-system-x86Upgrade qemu-kvmUpgrade qemu-system-arm | Nov 9, 2016 | Nov 9, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub