A NULL pointer dereference flaw was found in the megasas-gen2 SCSI host bus adapter emulation of QEMU in versions before and including 6.0. This issue occurs in the megasas_command_cancelled() callback function while dropping a SCSI request. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability.
CVSS Details
- CVSS 3.1 Base Score: 6
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qemu | Aug 22, 2024 | Jun 2, 2021 |
| Debian | — | No solution exists | May 15, 2025 | Jun 2, 2021 |
| Suse | — | Upgrade qemu-langUpgrade qemu-testsuiteUpgrade qemu-block-iscsiUpgrade qemu-hw-usb-smartcardUpgrade qemu-armUpgrade qemu-ui-spice-appUpgrade qemu-audio-alsaUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-seabiosUpgrade qemu-ipxeUpgrade qemu-chardev-spiceUpgrade qemu-hw-usb-redirectUpgrade qemu-block-sshUpgrade qemu-ui-gtkUpgrade qemu-ui-spice-coreUpgrade qemu-skibootUpgrade qemu-block-curlUpgrade qemu-block-dmgUpgrade qemu-ui-openglUpgrade qemu-linux-userUpgrade qemu-s390Upgrade qemu-audio-sdlUpgrade qemu-ksmUpgrade qemu-audio-ossUpgrade qemu-extraUpgrade qemu-ui-cursesUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-kvmUpgrade qemu-ivshmem-toolsUpgrade qemu-s390xUpgrade qemu-vhost-user-gpuUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-guest-agentUpgrade qemu-audio-spiceUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-block-nfsUpgrade qemu-ui-sdlUpgrade qemu-ppcUpgrade qemuUpgrade qemu-x86Upgrade qemu-microvmUpgrade qemu-hw-display-qxlUpgrade qemu-vgabiosUpgrade qemu-block-glusterUpgrade qemu-chardev-baumUpgrade qemu-toolsUpgrade qemu-sgabiosUpgrade qemu-block-rbdUpgrade qemu-audio-pa | Aug 21, 2021 | Jun 2, 2021 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Jun 2, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub