An information disclosure vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0. The flaw exists in virgl_cmd_get_capset_info() in contrib/vhost-user-gpu/virgl.c and could occur due to the read of uninitialized memory. A malicious guest could exploit this issue to leak memory from the host.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qemu | Aug 22, 2024 | Jun 2, 2021 |
| Debian | — | Upgrade qemu | Nov 4, 2022 | Jun 2, 2021 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Aug 16, 2022 | Jun 2, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade qemu-img | Jan 28, 2022 | Jun 2, 2021 |
| Oracle_linux | — | Upgrade qemu-kvm-block-curlUpgrade qemu-kvm-block-iscsiUpgrade libvirt-daemon-driver-nodedevUpgrade nbdkit-basic-filtersUpgrade libvirt-bash-completionUpgrade libguestfs-xfsUpgrade nbdkit-vddk-pluginUpgrade libnbdUpgrade python3-hivexUpgrade qemuUpgrade qemu-block-glusterUpgrade libvirt-daemon-driver-storage-glusterUpgrade superminUpgrade libvirt-daemon-driver-storage-mpathUpgrade libvirt-develUpgrade libguestfs-toolsUpgrade nbdfuseUpgrade python3-libguestfsUpgrade qemu-system-x86-coreUpgrade libguestfs-gobject-develUpgrade libiscsi-utilsUpgrade ivshmem-toolsUpgrade libvirt-adminUpgrade qemu-kvm-block-glusterUpgrade libguestfs-winsupportUpgrade libvirt-daemon-driver-nwfilterUpgrade libguestfs-rsyncUpgrade netcfUpgrade seabios-binUpgrade libguestfs-bash-completionUpgrade perl-Sys-GuestfsUpgrade qemu-block-rbdUpgrade libvirt-daemonUpgrade libguestfs-inspect-iconsUpgrade sgabiosUpgrade nbdkit-example-pluginsUpgrade nbdkit-serverUpgrade libguestfs-man-pages-jaUpgrade libvirt-daemon-config-networkUpgrade libguestfs-tools-cUpgrade qemu-kvmUpgrade libvirt-clientUpgrade libvirt-daemon-driver-secretUpgrade virt-v2vUpgrade libvirt-lock-sanlockUpgrade libguestfs-benchmarkingUpgrade libguestfs-man-pages-ukUpgrade libguestfs-rescueUpgrade nbdkit-curl-pluginUpgrade nbdkit-develUpgrade qemu-commonUpgrade libnbd-develUpgrade libvirt-daemon-kvmUpgrade libvirtUpgrade qemu-guest-agentUpgrade nbdkit-bash-completionUpgrade nbdkit-xz-filterUpgrade libvirt-docsUpgrade seabiosUpgrade qemu-system-aarch64-coreUpgrade lua-guestfsUpgrade nbdkit-linuxdisk-pluginUpgrade python3-libvirtUpgrade virt-dibUpgrade ruby-hivexUpgrade libvirt-daemon-driver-storage-scsiUpgrade hivexUpgrade libvirt-daemon-driver-storage-coreUpgrade libvirt-dbusUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-daemon-config-nwfilterUpgrade libguestfs-javaUpgrade hivex-develUpgrade qemu-kvm-coreUpgrade qemu-imgUpgrade libvirt-daemon-driver-storage-iscsi-directUpgrade perl-hivexUpgrade nbdkit-gzip-pluginUpgrade perl-Sys-VirtUpgrade libguestfs-develUpgrade seavgabios-binUpgrade netcf-develUpgrade nbdkit-basic-pluginsUpgrade libvirt-libsUpgrade libvirt-daemon-driver-storageUpgrade libvirt-daemon-driver-storage-logicalUpgrade libvirt-daemon-driver-storage-rbdUpgrade libvirt-daemon-driver-qemuUpgrade libiscsi-develUpgrade libiscsiUpgrade sgabios-binUpgrade qemu-kvm-block-sshUpgrade qemu-kvm-block-rbdUpgrade qemu-block-iscsiUpgrade libguestfs-javadocUpgrade libguestfs-gobjectUpgrade nbdkit-ssh-pluginUpgrade libvirt-daemon-driver-storage-iscsiUpgrade nbdkitUpgrade qemu-system-x86Upgrade qemu-kvm-commonUpgrade libvirt-daemon-driver-networkUpgrade supermin-develUpgrade ruby-libguestfsUpgrade python3-libnbdUpgrade libvirt-daemon-driver-storage-diskUpgrade netcf-libsUpgrade libguestfsUpgrade qemu-system-aarch64Upgrade nbdkit-python-pluginUpgrade libguestfs-gfs2Upgrade libvirt-nssUpgrade libguestfs-java-devel | Aug 17, 2021 | May 4, 2021 |
| Suse | — | Upgrade qemu-x86Upgrade qemu-microvmUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-skibootUpgrade qemu-hw-display-qxlUpgrade qemu-hw-usb-smartcardUpgrade qemu-toolsUpgrade qemu-vgabiosUpgrade qemu-ui-cursesUpgrade qemu-testsuiteUpgrade qemu-ui-gtkUpgrade qemu-block-glusterUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-langUpgrade qemu-hw-usb-redirectUpgrade qemu-block-curlUpgrade qemuUpgrade qemu-hw-usb-hostUpgrade qemu-ui-spice-coreUpgrade qemu-armUpgrade qemu-block-iscsiUpgrade qemu-linux-userUpgrade qemu-audio-alsaUpgrade qemu-ppcUpgrade qemu-audio-paUpgrade qemu-guest-agentUpgrade qemu-accel-tcg-x86Upgrade qemu-block-rbdUpgrade qemu-vhost-user-gpuUpgrade qemu-block-nfsUpgrade qemu-block-dmgUpgrade qemu-ipxeUpgrade qemu-block-sshUpgrade qemu-ui-spice-appUpgrade qemu-ui-openglUpgrade qemu-audio-spiceUpgrade qemu-audio-sdlUpgrade qemu-chardev-spiceUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-extraUpgrade qemu-SLOFUpgrade qemu-s390xUpgrade qemu-s390Upgrade qemu-ksmUpgrade qemu-ivshmem-toolsUpgrade qemu-seabiosUpgrade qemu-kvmUpgrade qemu-sgabiosUpgrade qemu-ui-sdlUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-chardev-baum | Jul 1, 2021 | Jun 2, 2021 |
| Ubuntu | — | Upgrade qemu-system-mipsUpgrade qemu-systemUpgrade qemu-system-miscUpgrade qemu-system-ppcUpgrade qemu-system-sparcUpgrade qemu-system-x86Upgrade qemu-system-x86-microvmUpgrade qemu-system-s390xUpgrade qemu-system-armUpgrade qemu-system-x86-xen | Jul 16, 2021 | Jun 2, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub