QEMU (aka Quick Emulator) built with the Virtio GPU Device emulator support is vulnerable to an information leakage issue. It could occur while processing 'VIRTIO_GPU_CMD_GET_CAPSET_INFO' command. A guest user/process could use this flaw to leak contents of the host memory bytes.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu | Jul 30, 2024 | Dec 29, 2016 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Oct 30, 2017 | Dec 29, 2016 |
| Suse | — | Upgrade qemu-ui-spice-coreUpgrade qemu-skibootUpgrade qemu-kvmUpgrade qemu-ksmUpgrade qemu-ui-cursesUpgrade qemu-block-curlUpgrade qemu-audio-spiceUpgrade qemu-chardev-baumUpgrade qemu-hw-usb-redirectUpgrade qemu-ipxeUpgrade qemu-ui-spice-appUpgrade qemu-seabiosUpgrade qemu-s390Upgrade qemu-block-iscsiUpgrade qemu-microvmUpgrade qemu-audio-alsaUpgrade qemu-ui-gtkUpgrade qemu-block-sshUpgrade qemu-s390xUpgrade qemu-block-rbdUpgrade qemu-langUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-armUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-hw-display-virtio-vgaUpgrade qemuUpgrade qemu-audio-paUpgrade qemu-audio-ossUpgrade qemu-ui-openglUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-guest-agentUpgrade qemu-toolsUpgrade qemu-vgabiosUpgrade qemu-hw-display-qxlUpgrade qemu-x86Upgrade qemu-chardev-spiceUpgrade qemu-ppcUpgrade qemu-sgabios | Jan 14, 2017 | Dec 29, 2016 |
| Ubuntu | — | Upgrade qemu-system-miscUpgrade qemu-system-mipsUpgrade qemu-system-ppcUpgrade qemu-system-x86Upgrade qemu-systemUpgrade qemu-system-sparcUpgrade qemu-system-armUpgrade qemu-system-aarch64Upgrade qemu-system-s390x | Apr 21, 2017 | Dec 29, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub