An OOB heap buffer r/w access issue was found in the NVM Express Controller emulation in QEMU. It could occur in nvme_cmb_ops routines in nvme device. A guest user/process could use this flaw to crash the QEMU process resulting in DoS or potentially run arbitrary code with privileges of the QEMU process.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- CVSS 3.0 Base Score: 7
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu | Jul 30, 2024 | Nov 2, 2018 |
| Huawei Euleros 2_0_sp8 | — | Upgrade qemu-img | Aug 31, 2020 | Nov 2, 2018 |
| Oracle_linux | — | Upgrade qemuUpgrade qemu-system-aarch64Upgrade qemu-kvm-coreUpgrade qemu-block-glusterUpgrade qemu-imgUpgrade qemu-commonUpgrade ivshmem-toolsUpgrade qemu-system-x86-coreUpgrade qemu-system-aarch64-coreUpgrade qemu-kvmUpgrade qemu-block-rbdUpgrade qemu-system-x86Upgrade qemu-block-iscsi | Dec 23, 2018 | Nov 1, 2018 |
| Suse | — | Upgrade qemu-audio-ossUpgrade qemu-s390xUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-toolsUpgrade qemu-chardev-spiceUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-skibootUpgrade qemu-ipxeUpgrade qemu-seabiosUpgrade qemu-audio-spiceUpgrade qemu-block-rbdUpgrade qemu-ui-spice-appUpgrade qemu-hw-display-qxlUpgrade qemu-ui-openglUpgrade qemuUpgrade qemu-block-sshUpgrade qemu-guest-agentUpgrade qemu-armUpgrade qemu-langUpgrade qemu-block-dmgUpgrade qemu-x86Upgrade qemu-ui-gtkUpgrade qemu-block-curlUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-hw-usb-redirectUpgrade qemu-ui-spice-coreUpgrade qemu-ksmUpgrade qemu-linux-userUpgrade qemu-block-iscsiUpgrade qemu-ui-cursesUpgrade qemu-ppcUpgrade qemu-audio-alsaUpgrade qemu-kvmUpgrade qemu-microvmUpgrade qemu-extraUpgrade qemu-s390Upgrade qemu-audio-paUpgrade qemu-block-glusterUpgrade qemu-chardev-baumUpgrade qemu-testsuiteUpgrade qemu-vgabiosUpgrade qemu-sgabios | Dec 7, 2018 | Nov 2, 2018 |
| Ubuntu | — | Upgrade qemu-system-s390xUpgrade qemu-system-armUpgrade qemu-system-sparcUpgrade qemu-system-ppcUpgrade qemu-systemUpgrade qemu-system-aarch64Upgrade qemu-system-x86Upgrade qemu-system-mipsUpgrade qemu-system-misc | Nov 30, 2018 | Nov 2, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub