Memory leak in the virtio_gpu_resource_create_2d function in hw/display/virtio-gpu.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_CREATE_2D commands.
CVSS Details
- CVSS 3.1 Base Score: 6
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qemu | Aug 22, 2024 | Dec 10, 2016 |
| Debian | — | Upgrade qemu | Jul 30, 2024 | Dec 10, 2016 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Oct 30, 2017 | Dec 9, 2016 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Sep 19, 2016 |
| Suse | — | Upgrade qemu-ui-spice-coreUpgrade qemu-toolsUpgrade qemu-hw-usb-redirectUpgrade qemu-block-sshUpgrade qemu-langUpgrade qemu-guest-agentUpgrade qemu-skibootUpgrade qemu-audio-paUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-microvmUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-armUpgrade qemu-block-curlUpgrade qemu-x86Upgrade qemu-hw-display-qxlUpgrade qemu-ppcUpgrade qemuUpgrade qemu-ui-gtkUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-block-iscsiUpgrade qemu-audio-ossUpgrade qemu-vgabiosUpgrade qemu-audio-alsaUpgrade qemu-audio-spiceUpgrade qemu-ui-spice-appUpgrade qemu-block-rbdUpgrade qemu-chardev-spiceUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-ipxeUpgrade qemu-ui-cursesUpgrade qemu-sgabiosUpgrade qemu-kvmUpgrade qemu-chardev-baumUpgrade qemu-ksmUpgrade qemu-s390Upgrade qemu-seabiosUpgrade qemu-ui-openglUpgrade qemu-s390x | Nov 23, 2016 | Nov 22, 2016 |
| Ubuntu | — | Upgrade qemu-kvmUpgrade qemu-system-armUpgrade qemu-system-ppcUpgrade qemu-system-s390xUpgrade qemu-system-x86Upgrade qemu-system-sparcUpgrade qemu-systemUpgrade qemu-system-miscUpgrade qemu-system-mipsUpgrade qemu-system-aarch64 | Nov 9, 2016 | Nov 9, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub