The pvscsi_convert_sglist function in hw/scsi/vmw_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop and QEMU process crash) by leveraging an incorrect cast.
CVSS Details
- CVSS 3.1 Base Score: 4.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu | Feb 20, 2019 | Dec 9, 2016 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Oct 30, 2017 | Dec 9, 2016 |
| Suse | — | Upgrade qemu-block-curlUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-ipxeUpgrade qemu-sgabiosUpgrade qemu-s390Upgrade qemu-audio-spiceUpgrade qemu-s390xUpgrade qemu-vgabiosUpgrade qemu-ui-spice-coreUpgrade qemu-block-sshUpgrade qemu-langUpgrade qemu-guest-agentUpgrade qemu-block-rbdUpgrade qemu-chardev-baumUpgrade qemu-ui-gtkUpgrade qemu-chardev-spiceUpgrade qemuUpgrade qemu-ppcUpgrade qemu-toolsUpgrade qemu-kvmUpgrade qemu-audio-alsaUpgrade qemu-skibootUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-block-iscsiUpgrade qemu-x86Upgrade qemu-audio-ossUpgrade qemu-armUpgrade qemu-seabiosUpgrade qemu-ksmUpgrade qemu-audio-paUpgrade qemu-hw-display-qxlUpgrade qemu-ui-openglUpgrade qemu-ui-spice-appUpgrade qemu-hw-usb-redirectUpgrade qemu-ui-cursesUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-microvmUpgrade qemu-hw-display-virtio-vga | Nov 3, 2016 | Oct 21, 2016 |
| Ubuntu | — | Upgrade qemu-system-x86Upgrade qemu-kvmUpgrade qemu-system-armUpgrade qemu-system-ppcUpgrade qemu-system-sparcUpgrade qemu-system-aarch64Upgrade qemu-system-mipsUpgrade qemu-systemUpgrade qemu-system-s390xUpgrade qemu-system-misc | Nov 9, 2016 | Nov 9, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub