Memory leak in the usb_xhci_exit function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator), when the xhci uses msix, allows local guest OS administrators to cause a denial of service (memory consumption and possibly QEMU process crash) by repeatedly unplugging a USB device.
CVSS Details
- CVSS 3.1 Base Score: 6
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu | Jul 30, 2024 | Dec 10, 2016 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Oct 30, 2017 | Dec 9, 2016 |
| Suse | — | Upgrade qemu-microvmUpgrade qemu-audio-paUpgrade qemu-block-iscsiUpgrade qemu-audio-alsaUpgrade qemu-s390xUpgrade qemu-ui-gtkUpgrade qemu-seabiosUpgrade qemu-block-curlUpgrade qemu-s390Upgrade qemu-langUpgrade qemu-kvmUpgrade qemu-block-sshUpgrade qemu-hw-usb-redirectUpgrade qemu-ksmUpgrade qemu-chardev-baumUpgrade qemu-block-rbdUpgrade qemu-guest-agentUpgrade qemu-ppcUpgrade qemu-vgabiosUpgrade qemu-ui-spice-appUpgrade qemu-ui-spice-coreUpgrade qemu-skibootUpgrade qemu-ui-cursesUpgrade qemu-audio-ossUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-x86Upgrade qemu-sgabiosUpgrade qemu-ipxeUpgrade qemu-audio-spiceUpgrade qemuUpgrade qemu-hw-display-qxlUpgrade qemu-ui-openglUpgrade qemu-toolsUpgrade qemu-armUpgrade qemu-chardev-spiceUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-hw-s390x-virtio-gpu-ccw | Nov 23, 2016 | Nov 22, 2016 |
| Ubuntu | — | Upgrade qemu-system-armUpgrade qemu-system-aarch64Upgrade qemu-system-miscUpgrade qemu-system-s390xUpgrade qemu-kvmUpgrade qemu-systemUpgrade qemu-system-mipsUpgrade qemu-system-ppcUpgrade qemu-system-x86Upgrade qemu-system-sparc | Nov 9, 2016 | Nov 9, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub