Memory leak in the virgl_resource_attach_backing function in hw/display/virtio-gpu-3d.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (host memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_ATTACH_BACKING commands.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qemu | Aug 22, 2024 | Mar 15, 2017 |
| Debian | — | Upgrade qemu | Jul 30, 2024 | Mar 15, 2017 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Oct 30, 2017 | Mar 15, 2017 |
| Suse | — | Upgrade qemu-audio-alsaUpgrade qemu-block-iscsiUpgrade qemu-seabiosUpgrade qemu-block-sshUpgrade qemu-ui-spice-coreUpgrade qemu-ksmUpgrade qemu-audio-ossUpgrade qemu-ui-openglUpgrade qemu-langUpgrade qemu-ipxeUpgrade qemu-s390Upgrade qemu-chardev-baumUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-block-curlUpgrade qemu-hw-usb-redirectUpgrade qemu-armUpgrade qemu-skibootUpgrade qemu-ui-spice-appUpgrade qemu-ui-cursesUpgrade qemu-chardev-spiceUpgrade qemu-ui-gtkUpgrade qemu-s390xUpgrade qemu-guest-agentUpgrade qemu-vgabiosUpgrade qemu-kvmUpgrade qemu-sgabiosUpgrade qemu-audio-paUpgrade qemu-block-rbdUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-hw-display-qxlUpgrade qemu-audio-spiceUpgrade qemuUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-microvmUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-x86Upgrade qemu-toolsUpgrade qemu-ppc | Mar 8, 2017 | Mar 7, 2017 |
| Ubuntu | — | Upgrade qemu-system-x86Upgrade qemu-system-aarch64Upgrade qemu-system-ppcUpgrade qemu-system-armUpgrade qemu-systemUpgrade qemu-system-sparcUpgrade qemu-system-miscUpgrade qemu-system-mipsUpgrade qemu-system-s390x | Apr 21, 2017 | Mar 8, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub