QEMU (aka Quick Emulator), when built with the IDE disk and CD/DVD-ROM Emulator support, allows local guest OS privileged users to cause a denial of service (NULL pointer dereference and QEMU process crash) by flushing an empty CDROM device drive.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu | Dec 5, 2017 | Aug 23, 2017 |
| Oracle_linux | — | Upgrade qemu-kvm-coreUpgrade qemu-system-aarch64-coreUpgrade qemu-block-iscsiUpgrade qemu-block-rbdUpgrade qemu-kvmUpgrade qemu-system-x86-coreUpgrade qemu-block-glusterUpgrade qemu-commonUpgrade ivshmem-toolsUpgrade qemu-imgUpgrade qemuUpgrade qemu-system-aarch64Upgrade qemu-system-x86 | May 15, 2019 | Jul 11, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Jul 11, 2017 |
| Suse | — | Upgrade qemu-vgabiosUpgrade qemu-block-iscsiUpgrade qemu-kvmUpgrade qemu-langUpgrade qemu-s390Upgrade qemu-guest-agentUpgrade qemu-ppcUpgrade qemu-block-sshUpgrade qemu-x86Upgrade qemu-block-curlUpgrade qemu-seabiosUpgrade qemu-ipxeUpgrade qemuUpgrade qemu-toolsUpgrade qemu-sgabiosUpgrade qemu-armUpgrade qemu-block-rbd | Nov 2, 2017 | Aug 23, 2017 |
| Ubuntu | — | Upgrade qemu-system-x86Upgrade qemu-systemUpgrade qemu-system-sparcUpgrade qemu-system-armUpgrade qemu-system-miscUpgrade qemu-system-ppcUpgrade qemu-system-s390xUpgrade qemu-system-mipsUpgrade qemu-system-aarch64 | Sep 13, 2017 | Aug 23, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub