QEMU (aka Quick Emulator) built with the Virtio GPU Device emulator support is vulnerable to an information leakage issue. It could occur while processing 'VIRTIO_GPU_CMD_GET_CAPSET_INFO' command. A guest user/process could use this flaw to leak contents of the host memory bytes.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu | Jul 30, 2024 | Dec 29, 2016 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Oct 30, 2017 | Dec 29, 2016 |
| Suse | — | Upgrade qemu-hw-display-qxlUpgrade qemu-audio-ossUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-s390xUpgrade qemu-vgabiosUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-langUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-toolsUpgrade qemu-armUpgrade qemu-block-rbdUpgrade qemu-block-sshUpgrade qemu-sgabiosUpgrade qemu-ppcUpgrade qemu-chardev-spiceUpgrade qemu-guest-agentUpgrade qemuUpgrade qemu-ui-openglUpgrade qemu-audio-paUpgrade qemu-x86Upgrade qemu-block-iscsiUpgrade qemu-s390Upgrade qemu-skibootUpgrade qemu-microvmUpgrade qemu-kvmUpgrade qemu-ui-spice-appUpgrade qemu-ksmUpgrade qemu-ipxeUpgrade qemu-block-curlUpgrade qemu-seabiosUpgrade qemu-ui-cursesUpgrade qemu-audio-alsaUpgrade qemu-ui-gtkUpgrade qemu-hw-usb-redirectUpgrade qemu-ui-spice-coreUpgrade qemu-audio-spiceUpgrade qemu-chardev-baum | Jan 14, 2017 | Dec 29, 2016 |
| Ubuntu | — | Upgrade qemu-systemUpgrade qemu-system-mipsUpgrade qemu-system-x86Upgrade qemu-system-sparcUpgrade qemu-system-ppcUpgrade qemu-system-miscUpgrade qemu-system-s390xUpgrade qemu-system-aarch64Upgrade qemu-system-arm | Apr 21, 2017 | Dec 29, 2016 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub