Memory leak in the megasas_handle_dcmd function in hw/scsi/megasas.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption) via MegaRAID Firmware Interface (MFI) commands with the sglist size set to a value over 2 Gb.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qemu | Aug 22, 2024 | Mar 16, 2017 |
| Debian | — | Upgrade qemu | Feb 19, 2019 | Mar 16, 2017 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Oct 30, 2017 | Mar 16, 2017 |
| Suse | — | Upgrade qemu-microvmUpgrade qemu-s390Upgrade qemu-ui-cursesUpgrade qemu-chardev-baumUpgrade qemu-audio-paUpgrade qemu-ppcUpgrade qemu-hw-usb-redirectUpgrade qemu-audio-alsaUpgrade xen-tools-domUUpgrade qemu-seabiosUpgrade qemu-kvmUpgrade qemu-ui-spice-coreUpgrade qemu-ui-gtkUpgrade qemu-langUpgrade qemu-block-iscsiUpgrade qemu-ksmUpgrade qemu-block-curlUpgrade xen-kmp-paeUpgrade qemu-x86Upgrade xenUpgrade qemu-vgabiosUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-guest-agentUpgrade qemu-chardev-spiceUpgrade xen-libs-32bitUpgrade qemu-audio-spiceUpgrade qemu-hw-display-qxlUpgrade xen-doc-htmlUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-hw-display-virtio-vgaUpgrade xen-develUpgrade xen-kmp-defaultUpgrade qemu-sgabiosUpgrade qemu-ipxeUpgrade qemuUpgrade xen-toolsUpgrade qemu-armUpgrade qemu-toolsUpgrade qemu-block-sshUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-s390xUpgrade qemu-ui-spice-appUpgrade qemu-audio-ossUpgrade qemu-block-rbdUpgrade kvmUpgrade qemu-skibootUpgrade qemu-ui-openglUpgrade xen-libs | Feb 28, 2017 | Feb 27, 2017 |
| Ubuntu | — | Upgrade qemu-system-x86Upgrade qemu-system-mipsUpgrade qemu-systemUpgrade qemu-system-s390xUpgrade qemu-system-armUpgrade qemu-system-ppcUpgrade qemu-system-miscUpgrade qemu-system-sparcUpgrade qemu-system-aarch64 | Apr 21, 2017 | Feb 27, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub