Use-after-free vulnerability in the sofree function in slirp/socket.c in QEMU (aka Quick Emulator) allows attackers to cause a denial of service (QEMU instance crash) by leveraging failure to properly clear ifq_so from pending packets.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade qemu-imgUpgrade qemu-kvm-debuginfoUpgrade qemu-kvm-toolsUpgrade qemu-kvmUpgrade qemu-kvm-common | Apr 27, 2020 | Sep 1, 2017 |
| Amazon_linux | — | Upgrade qemu-kvm | Jun 12, 2018 | Sep 1, 2017 |
| Centos_linux | — | Upgrade qemu-kvm-commonUpgrade qemu-kvm-debuginfoUpgrade qemu-kvmUpgrade qemu-imgUpgrade qemu-kvm-tools | Aug 28, 2019 | Sep 1, 2017 |
| Debian | — | Upgrade qemu | Dec 5, 2017 | Sep 1, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade qemu-img | May 29, 2018 | Sep 1, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade qemu-kvm-commonUpgrade qemu-kvmUpgrade qemu-img | May 3, 2018 | Sep 1, 2017 |
| Huawei Euleros 2_0_sp3 | — | Upgrade qemu-imgUpgrade qemu-kvmUpgrade qemu-kvm-common | Jul 3, 2018 | Sep 1, 2017 |
| Oracle_linux | — | Upgrade qemu-system-x86Upgrade qemu-imgUpgrade qemu-system-aarch64Upgrade qemu-kvm-toolsUpgrade qemu-system-aarch64-coreUpgrade qemu-kvm-coreUpgrade qemu-kvmUpgrade qemu-block-iscsiUpgrade qemu-block-glusterUpgrade qemu-kvm-commonUpgrade qemuUpgrade qemu-system-x86-coreUpgrade ivshmem-toolsUpgrade qemu-block-rbdUpgrade qemu-common | Apr 19, 2018 | Aug 3, 2017 |
| Redhat_linux | — | No solution existsUpgrade qemu-kvm-toolsUpgrade qemu-imgUpgrade qemu-kvm-commonUpgrade qemu-kvm-debuginfoUpgrade qemu-kvm | Apr 11, 2018 | Sep 1, 2017 |
| Suse | — | Upgrade qemu-s390Upgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-chardev-spiceUpgrade qemu-block-sshUpgrade qemu-ipxeUpgrade qemu-microvmUpgrade qemu-chardev-baumUpgrade qemu-audio-alsaUpgrade qemu-block-rbdUpgrade qemu-block-iscsiUpgrade qemu-vgabiosUpgrade qemu-seabiosUpgrade qemu-ksmUpgrade qemu-audio-spiceUpgrade qemu-kvmUpgrade qemu-s390xUpgrade qemu-ui-gtkUpgrade qemu-block-curlUpgrade qemu-hw-display-virtio-vgaUpgrade qemuUpgrade qemu-ui-openglUpgrade qemu-ui-cursesUpgrade qemu-guest-agentUpgrade qemu-ppcUpgrade qemu-toolsUpgrade qemu-hw-usb-redirectUpgrade qemu-langUpgrade qemu-x86Upgrade qemu-hw-display-qxlUpgrade qemu-audio-ossUpgrade qemu-ui-spice-coreUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-armUpgrade qemu-sgabiosUpgrade qemu-audio-paUpgrade qemu-ui-spice-appUpgrade qemu-skiboot | Nov 2, 2017 | Sep 1, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub