An out-of-bounds memory access flaw was found in the ATI VGA device emulation of QEMU. This flaw occurs in the ati_2d_blt() routine while handling MMIO write operations when the guest provides invalid values for the destination display parameters. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu | Nov 4, 2022 | Mar 3, 2022 |
| Oracle_linux | — | Upgrade libvirt-wiresharkUpgrade nbdkitUpgrade libvirt-daemon-driver-secretUpgrade perl-hivexUpgrade seabios-binUpgrade libvirt-daemon-driver-storage-iscsi-directUpgrade libvirt-docsUpgrade libvirt-daemon-driver-storage-logicalUpgrade netcf-libsUpgrade libvirt-daemon-driver-storage-diskUpgrade swtpm-tools-pkcs11Upgrade nbdkit-gzip-filterUpgrade qemu-kvm-commonUpgrade qemu-kvm-coreUpgrade hivex-develUpgrade nbdkit-nbd-pluginUpgrade libnbdUpgrade libguestfs-man-pages-ukUpgrade libvirt-daemon-driver-storage-mpathUpgrade libvirt-libsUpgrade libvirt-daemon-driver-interfaceUpgrade nbdkit-example-pluginsUpgrade sgabios-binUpgrade qemu-virtiofsdUpgrade ruby-hivexUpgrade nbdkit-ssh-pluginUpgrade qemu-imgUpgrade swtpm-develUpgrade libvirt-daemon-driver-storage-scsiUpgrade libvirt-dbusUpgrade virt-dibUpgrade swtpmUpgrade libtpms-develUpgrade nbdkit-bash-completionUpgrade qemu-block-iscsiUpgrade qemu-kvm-block-iscsiUpgrade libvirt-daemon-driver-storageUpgrade libguestfs-javaUpgrade netcfUpgrade libnbd-bash-completionUpgrade libvirt-daemon-config-networkUpgrade libguestfsUpgrade libguestfs-java-develUpgrade libguestfs-develUpgrade nbdfuseUpgrade python3-libvirtUpgrade libguestfs-tools-cUpgrade nbdkit-linuxdisk-pluginUpgrade libvirt-daemon-driver-storage-iscsiUpgrade libvirt-daemon-driver-storage-rbdUpgrade libvirt-develUpgrade perl-Sys-VirtUpgrade libvirt-daemon-driver-nwfilterUpgrade libguestfs-rsyncUpgrade qemu-system-aarch64-coreUpgrade libguestfs-gobjectUpgrade libiscsiUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-daemon-kvmUpgrade libvirt-adminUpgrade libguestfs-man-pages-jaUpgrade libguestfs-gfs2Upgrade qemu-system-x86Upgrade virt-v2v-man-pages-ukUpgrade nbdkit-curl-pluginUpgrade nbdkit-tmpdisk-pluginUpgrade libguestfs-benchmarkingUpgrade netcf-develUpgrade python3-libnbdUpgrade libvirt-daemon-driver-qemuUpgrade libguestfs-javadocUpgrade libvirt-nssUpgrade libvirt-bash-completionUpgrade qemu-kvm-block-glusterUpgrade libvirt-daemon-driver-networkUpgrade qemu-commonUpgrade libnbd-develUpgrade libvirt-daemon-driver-storage-coreUpgrade nbdkit-python-pluginUpgrade swtpm-libsUpgrade seavgabios-binUpgrade qemu-guest-agentUpgrade python3-libguestfsUpgrade nbdkit-tar-pluginUpgrade libvirt-clientUpgrade libguestfs-applianceUpgrade libvirt-daemon-driver-nodedevUpgrade qemu-kvm-block-sshUpgrade hivexUpgrade qemu-system-x86-coreUpgrade libguestfs-gobject-develUpgrade python3-hivexUpgrade libguestfs-xfsUpgrade nbdkit-basic-pluginsUpgrade qemuUpgrade nbdkit-gzip-pluginUpgrade ruby-libguestfsUpgrade libvirt-lock-sanlockUpgrade virt-v2v-bash-completionUpgrade virt-v2v-man-pages-jaUpgrade libguestfs-rescueUpgrade libvirt-daemonUpgrade libguestfs-winsupportUpgrade virt-v2vUpgrade superminUpgrade sgabiosUpgrade nbdkit-develUpgrade qemu-block-glusterUpgrade nbdkit-basic-filtersUpgrade libtpmsUpgrade libguestfs-inspect-iconsUpgrade nbdkit-xz-filterUpgrade qemu-kvm-block-rbdUpgrade nbdkit-serverUpgrade libiscsi-develUpgrade qemu-system-aarch64Upgrade qemu-kvmUpgrade lua-guestfsUpgrade qemu-kvm-block-curlUpgrade ivshmem-toolsUpgrade nbdkit-vddk-pluginUpgrade libvirt-daemon-driver-storage-glusterUpgrade nbdkit-tar-filterUpgrade libvirtUpgrade libiscsi-utilsUpgrade libguestfs-toolsUpgrade libguestfs-bash-completionUpgrade swtpm-toolsUpgrade supermin-develUpgrade seabiosUpgrade qemu-block-rbdUpgrade perl-Sys-Guestfs | Jan 24, 2023 | Jul 7, 2021 |
| Suse | — | Upgrade qemu-ppcUpgrade qemu-kvmUpgrade qemu-ui-spice-appUpgrade qemu-guest-agentUpgrade qemu-audio-spiceUpgrade qemu-chardev-baumUpgrade qemu-block-sshUpgrade qemu-toolsUpgrade qemu-accel-tcg-x86Upgrade qemu-hw-usb-smartcardUpgrade qemu-ui-spice-coreUpgrade qemu-vgabiosUpgrade qemu-block-rbdUpgrade qemu-hw-usb-redirectUpgrade qemu-hw-display-qxlUpgrade qemu-block-iscsiUpgrade qemu-ui-dbusUpgrade qemu-audio-dbusUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-ui-gtkUpgrade qemu-s390xUpgrade qemu-langUpgrade qemuUpgrade qemu-vhost-user-gpuUpgrade qemu-block-glusterUpgrade qemu-block-nfsUpgrade qemu-chardev-spiceUpgrade qemu-audio-jackUpgrade qemu-ipxeUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-ui-openglUpgrade qemu-audio-alsaUpgrade qemu-seabiosUpgrade qemu-ksmUpgrade qemu-audio-paUpgrade qemu-SLOFUpgrade qemu-armUpgrade qemu-ivshmem-toolsUpgrade qemu-x86Upgrade qemu-hw-usb-hostUpgrade qemu-s390Upgrade qemu-accel-qtestUpgrade qemu-sgabiosUpgrade qemu-block-curlUpgrade qemu-skibootUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-ui-cursesUpgrade qemu-microvmUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-extraUpgrade qemu-block-dmg | Aug 9, 2024 | Mar 3, 2022 |
| Ubuntu | — | Upgrade qemu-system-mipsUpgrade qemu-system-sparcUpgrade qemuUpgrade qemu-system-s390xUpgrade qemu-systemUpgrade qemu-system-x86Upgrade qemu-system-xenUpgrade qemu-system-x86-microvmUpgrade qemu-system-armUpgrade qemu-system-x86-xenUpgrade qemu-system-ppcUpgrade qemu-system-misc | Jan 9, 2024 | Mar 3, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub