QEMU (aka Quick Emulator), when built with the VGA display emulator support, allows local guest OS privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors involving display update.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade qemu-kvm-debuginfoUpgrade qemu-kvm-commonUpgrade qemu-kvm-toolsUpgrade qemu-kvmUpgrade qemu-img | Apr 27, 2020 | Sep 1, 2017 |
| Amazon_linux | — | Upgrade qemu-kvm | Jun 12, 2018 | Sep 1, 2017 |
| Centos_linux | — | Upgrade qemu-imgUpgrade qemu-kvmUpgrade qemu-kvm-toolsUpgrade qemu-kvm-debuginfoUpgrade qemu-guest-agentUpgrade qemu-kvm-common | Jul 17, 2018 | Sep 1, 2017 |
| Debian | — | Upgrade qemu | Dec 5, 2017 | Sep 1, 2017 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Apr 9, 2018 | Sep 1, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade qemu-img | May 29, 2018 | Sep 1, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade qemu-imgUpgrade qemu-kvmUpgrade qemu-kvm-common | May 3, 2018 | Sep 1, 2017 |
| Huawei Euleros 2_0_sp3 | — | Upgrade qemu-kvm-commonUpgrade qemu-imgUpgrade qemu-kvm | Jul 3, 2018 | Sep 1, 2017 |
| Oracle_linux | — | Upgrade qemuUpgrade qemu-commonUpgrade qemu-system-aarch64-coreUpgrade qemu-block-iscsiUpgrade qemu-system-x86-coreUpgrade qemu-imgUpgrade qemu-kvm-coreUpgrade qemu-block-rbdUpgrade qemu-guest-agentUpgrade qemu-kvm-commonUpgrade qemu-kvm-toolsUpgrade qemu-system-x86Upgrade qemu-system-aarch64Upgrade qemu-block-glusterUpgrade qemu-kvmUpgrade ivshmem-tools | Apr 19, 2018 | Aug 24, 2017 |
| Redhat_linux | — | Upgrade qemu-kvm-toolsUpgrade qemu-kvmNo solution existsUpgrade qemu-imgUpgrade qemu-kvm-commonUpgrade qemu-guest-agentUpgrade qemu-kvm-debuginfo | Apr 11, 2018 | Sep 1, 2017 |
| Suse | — | Upgrade qemu-hw-display-virtio-gpuUpgrade qemu-ipxeUpgrade qemu-toolsUpgrade qemu-sgabiosUpgrade xen-doc-htmlUpgrade qemu-ui-openglUpgrade qemu-armUpgrade xen-libsUpgrade qemu-audio-spiceUpgrade qemuUpgrade qemu-x86Upgrade qemu-hw-display-qxlUpgrade xen-libs-32bitUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade kvmUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-ui-cursesUpgrade qemu-hw-display-virtio-vgaUpgrade xen-tools-domuUpgrade qemu-audio-ossUpgrade qemu-chardev-spiceUpgrade xen-develUpgrade qemu-guest-agentUpgrade qemu-block-rbdUpgrade qemu-seabiosUpgrade qemu-skibootUpgrade qemu-s390Upgrade qemu-block-curlUpgrade xen-kmp-defaultUpgrade qemu-langUpgrade qemu-audio-alsaUpgrade qemu-ksmUpgrade xen-kmp-paeUpgrade qemu-audio-paUpgrade qemu-block-iscsiUpgrade qemu-ui-spice-appUpgrade qemu-ui-spice-coreUpgrade qemu-vgabiosUpgrade qemu-s390xUpgrade qemu-hw-usb-redirectUpgrade xenUpgrade qemu-microvmUpgrade xen-toolsUpgrade qemu-kvmUpgrade qemu-ppcUpgrade qemu-chardev-baumUpgrade qemu-block-sshUpgrade qemu-ui-gtk | Nov 2, 2017 | Sep 1, 2017 |
| Ubuntu | — | Upgrade qemu-system-aarch64Upgrade qemu-system-miscUpgrade qemu-system-armUpgrade qemu-system-sparcUpgrade qemu-system-s390xUpgrade qemu-systemUpgrade qemu-system-ppcUpgrade qemu-system-x86Upgrade qemu-system-mips | Feb 21, 2018 | Sep 1, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub