Quick Emulator (Qemu) built with the Virtio GPU Device emulator support is vulnerable to a memory leakage issue. It could occur while destroying gpu resource object in 'virtio_gpu_resource_destroy'. A guest user/process could use this flaw to leak host memory bytes, resulting in DoS for a host.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu | Jul 30, 2024 | Dec 23, 2016 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Oct 30, 2017 | Dec 23, 2016 |
| Suse | — | Upgrade qemu-ipxeUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-ui-openglUpgrade qemu-toolsUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-armUpgrade qemu-block-rbdUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-audio-spiceUpgrade qemuUpgrade qemu-hw-display-qxlUpgrade qemu-ui-spice-appUpgrade qemu-block-sshUpgrade qemu-chardev-spiceUpgrade qemu-sgabiosUpgrade qemu-s390xUpgrade qemu-skibootUpgrade qemu-audio-ossUpgrade qemu-ui-cursesUpgrade qemu-vgabiosUpgrade qemu-block-iscsiUpgrade qemu-ksmUpgrade qemu-audio-alsaUpgrade qemu-microvmUpgrade qemu-block-curlUpgrade qemu-ui-gtkUpgrade qemu-chardev-baumUpgrade qemu-hw-usb-redirectUpgrade qemu-guest-agentUpgrade qemu-ui-spice-coreUpgrade qemu-s390Upgrade qemu-ppcUpgrade qemu-kvmUpgrade qemu-audio-paUpgrade qemu-langUpgrade qemu-seabiosUpgrade qemu-x86Upgrade qemu-hw-s390x-virtio-gpu-ccw | Jan 14, 2017 | Dec 23, 2016 |
| Ubuntu | — | Upgrade qemu-system-mipsUpgrade qemu-system-aarch64Upgrade qemu-system-miscUpgrade qemu-systemUpgrade qemu-system-ppcUpgrade qemu-system-sparcUpgrade qemu-system-x86Upgrade qemu-system-s390xUpgrade qemu-system-arm | Apr 21, 2017 | Dec 23, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub