QEMU (aka Quick Emulator), when built with the IDE disk and CD/DVD-ROM Emulator support, allows local guest OS privileged users to cause a denial of service (NULL pointer dereference and QEMU process crash) by flushing an empty CDROM device drive.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu | Dec 5, 2017 | Aug 23, 2017 |
| Oracle_linux | — | Upgrade qemu-kvmUpgrade ivshmem-toolsUpgrade qemu-system-x86-coreUpgrade qemu-block-glusterUpgrade qemu-system-aarch64Upgrade qemu-commonUpgrade qemu-imgUpgrade qemuUpgrade qemu-system-x86Upgrade qemu-kvm-coreUpgrade qemu-block-rbdUpgrade qemu-system-aarch64-coreUpgrade qemu-block-iscsi | May 15, 2019 | Jul 11, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 11, 2017 |
| Suse | — | Upgrade qemu-ppcUpgrade qemu-seabiosUpgrade qemu-vgabiosUpgrade qemu-langUpgrade qemu-kvmUpgrade qemu-block-iscsiUpgrade qemu-block-curlUpgrade qemu-x86Upgrade qemu-s390Upgrade qemu-block-sshUpgrade qemu-guest-agentUpgrade qemu-armUpgrade qemu-toolsUpgrade qemu-ipxeUpgrade qemuUpgrade qemu-sgabiosUpgrade qemu-block-rbd | Nov 2, 2017 | Aug 23, 2017 |
| Ubuntu | — | Upgrade qemu-system-armUpgrade qemu-system-sparcUpgrade qemu-systemUpgrade qemu-system-x86Upgrade qemu-system-s390xUpgrade qemu-system-aarch64Upgrade qemu-system-mipsUpgrade qemu-system-miscUpgrade qemu-system-ppc | Sep 13, 2017 | Aug 23, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub