QEMU (aka Quick Emulator), when built with USB xHCI controller emulator support, allows local guest OS privileged users to cause a denial of service (infinite recursive call) via vectors involving control transfer descriptors sequencing.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu | Jul 27, 2017 | Jun 16, 2017 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 2, 2017 |
| Suse | — | Upgrade qemuUpgrade qemu-x86Upgrade qemu-ipxeUpgrade qemu-sgabiosUpgrade kvmUpgrade qemu-toolsUpgrade qemu-vgabiosUpgrade qemu-armUpgrade qemu-s390Upgrade qemu-kvmUpgrade qemu-block-sshUpgrade qemu-block-rbdUpgrade qemu-ppcUpgrade qemu-langUpgrade qemu-guest-agentUpgrade qemu-seabiosUpgrade qemu-block-curl | Jul 4, 2017 | Jun 16, 2017 |
| Ubuntu | — | Upgrade qemu-system-miscUpgrade qemu-system-aarch64Upgrade qemu-system-mipsUpgrade qemu-system-sparcUpgrade qemu-systemUpgrade qemu-system-x86Upgrade qemu-system-armUpgrade qemu-system-s390xUpgrade qemu-system-ppc | Sep 13, 2017 | Jun 16, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub