Memory leak in the megasas_handle_dcmd function in hw/scsi/megasas.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption) via MegaRAID Firmware Interface (MFI) commands with the sglist size set to a value over 2 Gb.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qemu | Aug 22, 2024 | Mar 16, 2017 |
| Debian | — | Upgrade qemu | Feb 19, 2019 | Mar 16, 2017 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Oct 30, 2017 | Mar 16, 2017 |
| Suse | — | Upgrade xen-develUpgrade qemu-chardev-spiceUpgrade xen-kmp-defaultUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-block-sshUpgrade xen-libsUpgrade qemu-ipxeUpgrade qemu-skibootUpgrade qemu-hw-display-virtio-gpuUpgrade xen-libs-32bitUpgrade qemu-ui-openglUpgrade qemu-block-rbdUpgrade qemu-hw-display-qxlUpgrade xen-doc-htmlUpgrade qemu-sgabiosUpgrade kvmUpgrade qemu-ui-spice-appUpgrade qemu-s390xUpgrade qemu-armUpgrade qemu-audio-ossUpgrade xen-toolsUpgrade qemu-toolsUpgrade qemuUpgrade qemu-audio-spiceUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade xenUpgrade qemu-block-curlUpgrade qemu-block-iscsiUpgrade qemu-ui-cursesUpgrade qemu-kvmUpgrade qemu-langUpgrade qemu-ksmUpgrade qemu-ui-gtkUpgrade qemu-audio-alsaUpgrade qemu-ui-spice-coreUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-seabiosUpgrade qemu-s390Upgrade qemu-hw-usb-redirectUpgrade qemu-audio-paUpgrade qemu-x86Upgrade qemu-guest-agentUpgrade qemu-chardev-baumUpgrade qemu-ppcUpgrade qemu-microvmUpgrade xen-kmp-paeUpgrade qemu-vgabiosUpgrade xen-tools-domu | Feb 28, 2017 | Feb 27, 2017 |
| Ubuntu | — | Upgrade qemu-systemUpgrade qemu-system-s390xUpgrade qemu-system-mipsUpgrade qemu-system-x86Upgrade qemu-system-ppcUpgrade qemu-system-aarch64Upgrade qemu-system-miscUpgrade qemu-system-armUpgrade qemu-system-sparc | Apr 21, 2017 | Feb 27, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub