Memory leak in the virgl_cmd_resource_unref function in hw/display/virtio-gpu-3d.c in QEMU (aka Quick Emulator) allows local guest OS users to cause a denial of service (host memory consumption) via a large number of VIRTIO_GPU_CMD_RESOURCE_UNREF commands sent without detaching the backing storage beforehand.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qemu | Aug 22, 2024 | Mar 16, 2017 |
| Debian | — | Upgrade qemu | Jul 30, 2024 | Mar 16, 2017 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Oct 30, 2017 | Mar 16, 2017 |
| Suse | — | Upgrade qemu-x86Upgrade qemu-hw-display-qxlUpgrade qemu-microvmUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-guest-agentUpgrade qemu-armUpgrade qemu-s390xUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-sgabiosUpgrade qemu-vgabiosUpgrade qemu-kvmUpgrade qemu-ppcUpgrade qemu-audio-paUpgrade qemu-hw-usb-redirectUpgrade qemu-ipxeUpgrade qemu-audio-spiceUpgrade qemuUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-langUpgrade qemu-toolsUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-chardev-spiceUpgrade qemu-block-rbdUpgrade qemu-block-sshUpgrade qemu-seabiosUpgrade qemu-s390Upgrade qemu-audio-alsaUpgrade qemu-ui-cursesUpgrade qemu-ksmUpgrade qemu-block-iscsiUpgrade qemu-ui-spice-coreUpgrade qemu-audio-ossUpgrade qemu-ui-openglUpgrade qemu-ui-gtkUpgrade qemu-ui-spice-appUpgrade qemu-skibootUpgrade qemu-block-curlUpgrade qemu-chardev-baum | Mar 8, 2017 | Mar 7, 2017 |
| Ubuntu | — | Upgrade qemu-system-armUpgrade qemu-system-miscUpgrade qemu-system-s390xUpgrade qemu-system-sparcUpgrade qemu-system-x86Upgrade qemu-system-mipsUpgrade qemu-systemUpgrade qemu-system-ppcUpgrade qemu-system-aarch64 | Apr 21, 2017 | Mar 7, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub