Quick Emulator (Qemu) built with the Virtio GPU Device emulator support is vulnerable to a memory leakage issue. It could occur while destroying gpu resource object in 'virtio_gpu_resource_destroy'. A guest user/process could use this flaw to leak host memory bytes, resulting in DoS for a host.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu | Jul 30, 2024 | Dec 23, 2016 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Oct 30, 2017 | Dec 23, 2016 |
| Suse | — | Upgrade qemu-hw-display-virtio-vgaUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-block-rbdUpgrade qemu-ipxeUpgrade qemuUpgrade qemu-hw-display-qxlUpgrade qemu-audio-spiceUpgrade qemu-block-sshUpgrade qemu-audio-ossUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-ui-spice-appUpgrade qemu-armUpgrade qemu-skibootUpgrade qemu-s390xUpgrade qemu-chardev-spiceUpgrade qemu-sgabiosUpgrade qemu-ui-openglUpgrade qemu-toolsUpgrade qemu-microvmUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-seabiosUpgrade qemu-guest-agentUpgrade qemu-vgabiosUpgrade qemu-audio-paUpgrade qemu-kvmUpgrade qemu-x86Upgrade qemu-hw-usb-redirectUpgrade qemu-chardev-baumUpgrade qemu-audio-alsaUpgrade qemu-ui-gtkUpgrade qemu-ppcUpgrade qemu-block-iscsiUpgrade qemu-langUpgrade qemu-ksmUpgrade qemu-ui-spice-coreUpgrade qemu-s390Upgrade qemu-block-curlUpgrade qemu-ui-curses | Jan 14, 2017 | Dec 23, 2016 |
| Ubuntu | — | Upgrade qemu-system-x86Upgrade qemu-system-ppcUpgrade qemu-system-miscUpgrade qemu-system-aarch64Upgrade qemu-system-mipsUpgrade qemu-systemUpgrade qemu-system-sparcUpgrade qemu-system-armUpgrade qemu-system-s390x | Apr 21, 2017 | Dec 23, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub