An out-of-bounds memory access flaw was found in the ATI VGA device emulation of QEMU. This flaw occurs in the ati_2d_blt() routine while handling MMIO write operations when the guest provides invalid values for the destination display parameters. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu | Nov 4, 2022 | Mar 3, 2022 |
| Oracle_linux | — | Upgrade qemu-block-glusterUpgrade ruby-libguestfsUpgrade superminUpgrade virt-v2vUpgrade libguestfs-winsupportUpgrade ivshmem-toolsUpgrade libguestfs-javadocUpgrade libvirt-daemon-driver-qemuUpgrade libvirt-daemon-driver-storage-coreUpgrade sgabiosUpgrade libtpmsUpgrade nbdkit-develUpgrade nbdkit-vddk-pluginUpgrade python3-libnbdUpgrade libvirt-daemonUpgrade libguestfs-gobject-develUpgrade qemu-kvm-block-curlUpgrade seabiosUpgrade virt-v2v-bash-completionUpgrade qemu-kvmUpgrade supermin-develUpgrade nbdkit-xz-filterUpgrade perl-Sys-GuestfsUpgrade qemu-block-rbdUpgrade swtpm-toolsUpgrade libguestfs-bash-completionUpgrade libiscsi-utilsUpgrade libvirt-daemon-driver-networkUpgrade libvirtUpgrade qemu-commonUpgrade libvirt-bash-completionUpgrade nbdkit-tar-filterUpgrade libvirt-daemon-driver-storage-glusterUpgrade libvirt-lock-sanlockUpgrade libguestfs-toolsUpgrade libnbd-develUpgrade qemuUpgrade virt-v2v-man-pages-jaUpgrade qemu-kvm-block-rbdUpgrade libvirt-nssUpgrade qemu-kvm-block-glusterUpgrade libguestfs-inspect-iconsUpgrade lua-guestfsUpgrade libvirt-clientUpgrade qemu-system-aarch64Upgrade python3-libguestfsUpgrade libguestfs-rescueUpgrade libguestfs-benchmarkingUpgrade nbdkit-basic-filtersUpgrade libvirt-daemon-driver-nodedevUpgrade libiscsi-develUpgrade nbdkit-tar-pluginUpgrade libguestfs-applianceUpgrade nbdkit-gzip-pluginUpgrade nbdkit-serverUpgrade qemu-guest-agentUpgrade qemu-kvm-block-sshUpgrade hivexUpgrade python3-hivexUpgrade qemu-system-x86-coreUpgrade netcf-develUpgrade nbdkit-basic-pluginsUpgrade seavgabios-binUpgrade swtpm-libsUpgrade libguestfs-xfsUpgrade nbdkit-python-pluginUpgrade libguestfs-man-pages-ukUpgrade swtpm-develUpgrade ruby-hivexUpgrade nbdkit-nbd-pluginUpgrade libvirt-libsUpgrade virt-v2v-man-pages-ukUpgrade nbdkit-gzip-filterUpgrade libvirt-docsUpgrade libguestfs-rsyncUpgrade qemu-kvm-commonUpgrade python3-libvirtUpgrade libvirt-dbusUpgrade virt-dibUpgrade netcfUpgrade libvirt-daemon-driver-nwfilterUpgrade libvirt-daemon-config-networkUpgrade nbdkit-ssh-pluginUpgrade libvirt-daemon-driver-storageUpgrade libtpms-develUpgrade perl-hivexUpgrade seabios-binUpgrade libvirt-adminUpgrade libiscsiUpgrade nbdkitUpgrade libvirt-develUpgrade libvirt-daemon-driver-storage-rbdUpgrade libvirt-wiresharkUpgrade swtpm-tools-pkcs11Upgrade libvirt-daemon-driver-storage-iscsi-directUpgrade libvirt-daemon-driver-storage-diskUpgrade libvirt-daemon-driver-secretUpgrade qemu-system-aarch64-coreUpgrade netcf-libsUpgrade sgabios-binUpgrade nbdfuseUpgrade qemu-system-x86Upgrade perl-Sys-VirtUpgrade libvirt-daemon-driver-storage-iscsiUpgrade libguestfs-tools-cUpgrade libguestfs-man-pages-jaUpgrade libguestfs-javaUpgrade libguestfsUpgrade qemu-kvm-coreUpgrade nbdkit-tmpdisk-pluginUpgrade libvirt-daemon-driver-storage-scsiUpgrade libnbdUpgrade libvirt-daemon-driver-storage-logicalUpgrade swtpmUpgrade qemu-kvm-block-iscsiUpgrade qemu-block-iscsiUpgrade nbdkit-bash-completionUpgrade nbdkit-example-pluginsUpgrade libnbd-bash-completionUpgrade nbdkit-linuxdisk-pluginUpgrade libguestfs-java-develUpgrade hivex-develUpgrade qemu-virtiofsdUpgrade nbdkit-curl-pluginUpgrade libvirt-daemon-driver-interfaceUpgrade qemu-imgUpgrade libguestfs-develUpgrade libvirt-daemon-kvmUpgrade libvirt-daemon-config-nwfilterUpgrade libguestfs-gobjectUpgrade libguestfs-gfs2Upgrade libvirt-daemon-driver-storage-mpath | Jan 24, 2023 | Jul 7, 2021 |
| Suse | — | Upgrade qemu-x86Upgrade qemu-microvmUpgrade qemu-accel-qtestUpgrade qemu-hw-usb-hostUpgrade qemu-sgabiosUpgrade qemu-ui-openglUpgrade qemu-audio-alsaUpgrade qemu-seabiosUpgrade qemu-armUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-block-dmgUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-skibootUpgrade qemu-ui-cursesUpgrade qemu-SLOFUpgrade qemu-ksmUpgrade qemu-audio-paUpgrade qemu-s390Upgrade qemu-ivshmem-toolsUpgrade qemu-extraUpgrade qemu-block-curlUpgrade qemu-audio-spiceUpgrade qemu-ipxeUpgrade qemu-langUpgrade qemu-vhost-user-gpuUpgrade qemu-ui-spice-coreUpgrade qemu-s390xUpgrade qemu-block-rbdUpgrade qemu-ppcUpgrade qemu-hw-display-qxlUpgrade qemu-audio-dbusUpgrade qemu-chardev-baumUpgrade qemu-vgabiosUpgrade qemuUpgrade qemu-hw-usb-redirectUpgrade qemu-block-sshUpgrade qemu-ui-spice-appUpgrade qemu-guest-agentUpgrade qemu-toolsUpgrade qemu-accel-tcg-x86Upgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-chardev-spiceUpgrade qemu-block-nfsUpgrade qemu-hw-usb-smartcardUpgrade qemu-block-glusterUpgrade qemu-block-iscsiUpgrade qemu-ui-dbusUpgrade qemu-kvmUpgrade qemu-ui-gtkUpgrade qemu-audio-jack | Aug 9, 2024 | Mar 3, 2022 |
| Ubuntu | — | Upgrade qemu-system-x86-microvmUpgrade qemu-system-ppcUpgrade qemu-system-xenUpgrade qemu-system-x86Upgrade qemu-system-miscUpgrade qemu-system-x86-xenUpgrade qemuUpgrade qemu-system-s390xUpgrade qemu-system-armUpgrade qemu-systemUpgrade qemu-system-mipsUpgrade qemu-system-sparc | Jan 9, 2024 | Mar 3, 2022 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub