Memory leak in the v9fs_device_unrealize_common function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local privileged guest OS users to cause a denial of service (host memory consumption and possibly QEMU process crash) via vectors involving the order of resource cleanup.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu | Jul 30, 2024 | Dec 29, 2016 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Oct 30, 2017 | Dec 29, 2016 |
| Suse | — | Upgrade qemu-block-sshUpgrade qemu-block-rbdUpgrade qemuUpgrade qemu-audio-ossUpgrade qemu-audio-spiceUpgrade qemu-sgabiosUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-toolsUpgrade qemu-ui-openglUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-skibootUpgrade qemu-hw-display-qxlUpgrade qemu-armUpgrade qemu-ipxeUpgrade qemu-chardev-spiceUpgrade qemu-ui-spice-appUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-guest-agentUpgrade qemu-ppcUpgrade qemu-kvmUpgrade qemu-block-iscsiUpgrade qemu-x86Upgrade qemu-audio-alsaUpgrade qemu-vgabiosUpgrade qemu-chardev-baumUpgrade qemu-microvmUpgrade qemu-hw-usb-redirectUpgrade qemu-langUpgrade qemu-ksmUpgrade qemu-ui-spice-coreUpgrade qemu-ui-gtkUpgrade qemu-block-curlUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-s390xUpgrade qemu-ui-cursesUpgrade qemu-audio-paUpgrade qemu-seabiosUpgrade qemu-s390 | Jan 14, 2017 | Dec 29, 2016 |
| Ubuntu | — | Upgrade qemu-system-ppcUpgrade qemu-system-mipsUpgrade qemu-system-s390xUpgrade qemu-systemUpgrade qemu-system-armUpgrade qemu-system-miscUpgrade qemu-system-aarch64Upgrade qemu-system-sparcUpgrade qemu-system-x86 | Apr 21, 2017 | Dec 29, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub