An OOB heap buffer r/w access issue was found in the NVM Express Controller emulation in QEMU. It could occur in nvme_cmb_ops routines in nvme device. A guest user/process could use this flaw to crash the QEMU process resulting in DoS or potentially run arbitrary code with privileges of the QEMU process.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- CVSS 3.0 Base Score: 7
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu | Jul 30, 2024 | Nov 2, 2018 |
| Huawei Euleros 2_0_sp8 | — | Upgrade qemu-img | Aug 31, 2020 | Nov 2, 2018 |
| Oracle_linux | — | Upgrade qemu-imgUpgrade qemu-commonUpgrade qemu-block-glusterUpgrade qemu-system-aarch64Upgrade qemuUpgrade qemu-kvm-coreUpgrade qemu-system-x86Upgrade qemu-system-aarch64-coreUpgrade qemu-block-rbdUpgrade qemu-kvmUpgrade qemu-block-iscsiUpgrade ivshmem-toolsUpgrade qemu-system-x86-core | Dec 23, 2018 | Nov 1, 2018 |
| Suse | — | Upgrade qemu-block-dmgUpgrade qemu-ui-gtkUpgrade qemu-block-curlUpgrade qemu-audio-paUpgrade qemu-block-glusterUpgrade qemu-kvmUpgrade qemu-audio-alsaUpgrade qemu-extraUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-s390Upgrade qemu-microvmUpgrade qemu-vgabiosUpgrade qemu-linux-userUpgrade qemu-ui-cursesUpgrade qemu-block-iscsiUpgrade qemu-x86Upgrade qemu-ksmUpgrade qemu-sgabiosUpgrade qemu-chardev-baumUpgrade qemu-ui-spice-coreUpgrade qemu-ppcUpgrade qemu-hw-usb-redirectUpgrade qemu-testsuiteUpgrade qemu-langUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-seabiosUpgrade qemu-skibootUpgrade qemuUpgrade qemu-hw-display-qxlUpgrade qemu-s390xUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-toolsUpgrade qemu-chardev-spiceUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-audio-ossUpgrade qemu-ui-openglUpgrade qemu-armUpgrade qemu-ipxeUpgrade qemu-block-sshUpgrade qemu-guest-agentUpgrade qemu-ui-spice-appUpgrade qemu-audio-spiceUpgrade qemu-block-rbd | Dec 7, 2018 | Nov 2, 2018 |
| Ubuntu | — | Upgrade qemu-system-mipsUpgrade qemu-system-aarch64Upgrade qemu-system-miscUpgrade qemu-system-ppcUpgrade qemu-systemUpgrade qemu-system-x86Upgrade qemu-system-sparcUpgrade qemu-system-s390xUpgrade qemu-system-arm | Nov 30, 2018 | Nov 2, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub