Memory leak in the usb_xhci_exit function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator), when the xhci uses msix, allows local guest OS administrators to cause a denial of service (memory consumption and possibly QEMU process crash) by repeatedly unplugging a USB device.
CVSS Details
- CVSS 3.1 Base Score: 6
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu | Jul 30, 2024 | Dec 10, 2016 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Oct 30, 2017 | Dec 9, 2016 |
| Suse | — | Upgrade qemu-hw-usb-redirectUpgrade qemu-s390Upgrade qemu-guest-agentUpgrade qemu-ppcUpgrade qemu-s390xUpgrade qemu-seabiosUpgrade qemu-block-curlUpgrade qemu-block-rbdUpgrade qemu-block-sshUpgrade qemu-ui-spice-coreUpgrade qemu-audio-alsaUpgrade qemu-ui-gtkUpgrade qemu-block-iscsiUpgrade qemu-kvmUpgrade qemu-chardev-baumUpgrade qemu-microvmUpgrade qemu-langUpgrade qemu-ksmUpgrade qemu-ui-spice-appUpgrade qemu-vgabiosUpgrade qemu-audio-paUpgrade qemu-skibootUpgrade qemuUpgrade qemu-armUpgrade qemu-hw-display-qxlUpgrade qemu-ipxeUpgrade qemu-ui-openglUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-chardev-spiceUpgrade qemu-audio-ossUpgrade qemu-audio-spiceUpgrade qemu-sgabiosUpgrade qemu-toolsUpgrade qemu-ui-cursesUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-x86 | Nov 23, 2016 | Nov 22, 2016 |
| Ubuntu | — | Upgrade qemu-systemUpgrade qemu-system-sparcUpgrade qemu-system-x86Upgrade qemu-system-mipsUpgrade qemu-system-ppcUpgrade qemu-system-s390xUpgrade qemu-system-armUpgrade qemu-system-miscUpgrade qemu-kvmUpgrade qemu-system-aarch64 | Nov 9, 2016 | Nov 9, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub