Memory leak in the megasas_handle_dcmd function in hw/scsi/megasas.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption) via MegaRAID Firmware Interface (MFI) commands with the sglist size set to a value over 2 Gb.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qemu | Aug 22, 2024 | Mar 16, 2017 |
| Debian | — | Upgrade qemu | Feb 19, 2019 | Mar 16, 2017 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Oct 30, 2017 | Mar 16, 2017 |
| Suse | — | Upgrade qemu-block-iscsiUpgrade qemu-ui-spice-coreUpgrade qemu-hw-usb-redirectUpgrade qemu-ui-cursesUpgrade xen-kmp-paeUpgrade qemu-audio-paUpgrade qemu-chardev-baumUpgrade qemu-guest-agentUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-seabiosUpgrade qemu-audio-alsaUpgrade qemu-ksmUpgrade qemu-vgabiosUpgrade qemu-block-curlUpgrade qemu-ui-gtkUpgrade qemu-langUpgrade qemu-kvmUpgrade qemu-s390Upgrade xen-tools-domUUpgrade qemu-microvmUpgrade qemu-ppcUpgrade xenUpgrade qemu-x86Upgrade xen-libsUpgrade qemu-block-rbdUpgrade qemu-audio-ossUpgrade qemu-skibootUpgrade qemu-ipxeUpgrade qemu-ui-openglUpgrade kvmUpgrade qemu-sgabiosUpgrade xen-kmp-defaultUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-toolsUpgrade qemuUpgrade xen-toolsUpgrade qemu-armUpgrade xen-libs-32bitUpgrade qemu-s390xUpgrade qemu-ui-spice-appUpgrade qemu-block-sshUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade xen-develUpgrade qemu-audio-spiceUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-chardev-spiceUpgrade xen-doc-htmlUpgrade qemu-hw-display-qxl | Feb 28, 2017 | Feb 27, 2017 |
| Ubuntu | — | Upgrade qemu-system-aarch64Upgrade qemu-system-ppcUpgrade qemu-system-sparcUpgrade qemu-system-armUpgrade qemu-system-miscUpgrade qemu-system-x86Upgrade qemu-systemUpgrade qemu-system-mipsUpgrade qemu-system-s390x | Apr 21, 2017 | Feb 27, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub