Use-after-free vulnerability in the sofree function in slirp/socket.c in QEMU (aka Quick Emulator) allows attackers to cause a denial of service (QEMU instance crash) by leveraging failure to properly clear ifq_so from pending packets.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade qemu-kvm-toolsUpgrade qemu-kvmUpgrade qemu-kvm-commonUpgrade qemu-kvm-debuginfoUpgrade qemu-img | Apr 27, 2020 | Sep 1, 2017 |
| Amazon_linux | — | Upgrade qemu-kvm | Jun 12, 2018 | Sep 1, 2017 |
| Centos_linux | — | Upgrade qemu-kvm-commonUpgrade qemu-kvm-debuginfoUpgrade qemu-kvm-toolsUpgrade qemu-imgUpgrade qemu-kvm | Aug 28, 2019 | Sep 1, 2017 |
| Debian | — | Upgrade qemu | Dec 5, 2017 | Sep 1, 2017 |
| Huawei Euleros 2_0_sp1 | — | Upgrade qemu-img | May 29, 2018 | Sep 1, 2017 |
| Huawei Euleros 2_0_sp2 | — | Upgrade qemu-kvmUpgrade qemu-imgUpgrade qemu-kvm-common | May 3, 2018 | Sep 1, 2017 |
| Huawei Euleros 2_0_sp3 | — | Upgrade qemu-imgUpgrade qemu-kvmUpgrade qemu-kvm-common | Jul 3, 2018 | Sep 1, 2017 |
| Oracle_linux | — | Upgrade qemu-system-aarch64-coreUpgrade qemu-imgUpgrade qemu-kvm-coreUpgrade qemu-system-x86Upgrade qemu-kvm-toolsUpgrade qemu-kvmUpgrade qemu-system-aarch64Upgrade qemu-kvm-commonUpgrade ivshmem-toolsUpgrade qemu-block-rbdUpgrade qemuUpgrade qemu-block-glusterUpgrade qemu-system-x86-coreUpgrade qemu-commonUpgrade qemu-block-iscsi | Apr 19, 2018 | Aug 3, 2017 |
| Redhat_linux | — | Upgrade qemu-imgUpgrade qemu-kvm-toolsNo solution existsUpgrade qemu-kvm-debuginfoUpgrade qemu-kvmUpgrade qemu-kvm-common | Apr 11, 2018 | Sep 1, 2017 |
| Suse | — | Upgrade qemu-block-sshUpgrade qemu-block-rbdUpgrade qemu-ksmUpgrade qemu-microvmUpgrade qemu-chardev-baumUpgrade qemu-chardev-spiceUpgrade qemu-ipxeUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-s390Upgrade qemu-audio-alsaUpgrade qemu-vgabiosUpgrade qemu-block-iscsiUpgrade qemu-s390xUpgrade qemu-audio-spiceUpgrade qemu-kvmUpgrade qemu-seabiosUpgrade qemu-ui-gtkUpgrade qemu-block-curlUpgrade qemu-ui-cursesUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-armUpgrade qemuUpgrade qemu-ui-openglUpgrade qemu-audio-paUpgrade qemu-hw-usb-redirectUpgrade qemu-guest-agentUpgrade qemu-ppcUpgrade qemu-toolsUpgrade qemu-ui-spice-appUpgrade qemu-sgabiosUpgrade qemu-langUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-x86Upgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-hw-display-qxlUpgrade qemu-skibootUpgrade qemu-ui-spice-coreUpgrade qemu-audio-oss | Nov 2, 2017 | Sep 1, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub