Memory leak in the virgl_resource_attach_backing function in hw/display/virtio-gpu-3d.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (host memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_ATTACH_BACKING commands.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qemu | Aug 22, 2024 | Mar 15, 2017 |
| Debian | — | Upgrade qemu | Jul 30, 2024 | Mar 15, 2017 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Oct 30, 2017 | Mar 15, 2017 |
| Suse | — | Upgrade qemu-s390xUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-guest-agentUpgrade qemu-hw-display-qxlUpgrade qemu-audio-spiceUpgrade qemu-toolsUpgrade qemu-x86Upgrade qemu-audio-paUpgrade qemu-ppcUpgrade qemu-block-rbdUpgrade qemu-vgabiosUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-kvmUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemuUpgrade qemu-sgabiosUpgrade qemu-microvmUpgrade qemu-chardev-baumUpgrade qemu-ui-spice-appUpgrade qemu-chardev-spiceUpgrade qemu-audio-ossUpgrade qemu-block-curlUpgrade qemu-block-iscsiUpgrade qemu-block-sshUpgrade qemu-seabiosUpgrade qemu-ui-cursesUpgrade qemu-ui-gtkUpgrade qemu-ipxeUpgrade qemu-skibootUpgrade qemu-audio-alsaUpgrade qemu-s390Upgrade qemu-ui-spice-coreUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-armUpgrade qemu-ksmUpgrade qemu-ui-openglUpgrade qemu-langUpgrade qemu-hw-usb-redirect | Mar 8, 2017 | Mar 7, 2017 |
| Ubuntu | — | Upgrade qemu-system-sparcUpgrade qemu-system-aarch64Upgrade qemu-system-ppcUpgrade qemu-system-x86Upgrade qemu-systemUpgrade qemu-system-armUpgrade qemu-system-miscUpgrade qemu-system-s390xUpgrade qemu-system-mips | Apr 21, 2017 | Mar 8, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub