QEMU (aka Quick Emulator) built with the Virtio GPU Device emulator support is vulnerable to a memory leakage issue. It could occur while updating the cursor data in update_cursor_data_virgl. A guest user/process could use this flaw to leak host memory bytes, resulting in DoS for a host.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu | Jul 30, 2024 | Dec 29, 2016 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Oct 30, 2017 | Dec 29, 2016 |
| Suse | — | Upgrade qemu-seabiosUpgrade qemu-ui-openglUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-armUpgrade qemu-chardev-spiceUpgrade qemu-audio-ossUpgrade qemuUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-s390xUpgrade qemu-hw-display-qxlUpgrade qemu-toolsUpgrade qemu-ipxeUpgrade qemu-block-rbdUpgrade qemu-ui-spice-appUpgrade qemu-guest-agentUpgrade qemu-block-sshUpgrade qemu-audio-spiceUpgrade qemu-langUpgrade qemu-skibootUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-ui-cursesUpgrade qemu-ksmUpgrade qemu-audio-alsaUpgrade qemu-sgabiosUpgrade qemu-ui-gtkUpgrade qemu-chardev-baumUpgrade qemu-s390Upgrade qemu-block-curlUpgrade qemu-ui-spice-coreUpgrade qemu-kvmUpgrade qemu-vgabiosUpgrade qemu-audio-paUpgrade qemu-microvmUpgrade qemu-x86Upgrade qemu-hw-usb-redirectUpgrade qemu-block-iscsiUpgrade qemu-ppc | Jan 14, 2017 | Dec 29, 2016 |
| Ubuntu | — | Upgrade qemu-system-armUpgrade qemu-system-sparcUpgrade qemu-system-x86Upgrade qemu-system-ppcUpgrade qemu-system-miscUpgrade qemu-systemUpgrade qemu-system-mipsUpgrade qemu-system-s390xUpgrade qemu-system-aarch64 | Apr 21, 2017 | Dec 29, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub