An out-of-bounds memory access flaw was found in the ATI VGA device emulation of QEMU. This flaw occurs in the ati_2d_blt() routine while handling MMIO write operations when the guest provides invalid values for the destination display parameters. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu | Nov 4, 2022 | Mar 3, 2022 |
| Oracle_linux | — | Upgrade libvirt-daemon-config-nwfilterUpgrade libguestfs-gobjectUpgrade libvirt-daemon-config-networkUpgrade libvirt-daemon-driver-storageUpgrade netcfUpgrade libguestfs-gfs2Upgrade hivex-develUpgrade nbdfuseUpgrade nbdkit-ssh-pluginUpgrade libguestfs-rsyncUpgrade libvirt-docsUpgrade libvirt-daemon-kvmUpgrade virt-v2v-man-pages-ukUpgrade qemu-kvm-commonUpgrade libvirt-daemon-driver-nwfilterUpgrade libtpms-develUpgrade nbdkit-bash-completionUpgrade libvirt-daemon-driver-storage-logicalUpgrade libvirt-dbusUpgrade perl-Sys-VirtUpgrade libnbd-bash-completionUpgrade qemu-system-x86Upgrade ruby-hivexUpgrade libguestfs-man-pages-jaUpgrade libguestfs-tools-cUpgrade libvirt-daemon-driver-storage-iscsiUpgrade libguestfs-man-pages-ukUpgrade libvirt-daemon-driver-storage-mpathUpgrade swtpm-develUpgrade libvirt-libsUpgrade sgabios-binUpgrade libvirt-daemon-driver-storage-diskUpgrade nbdkit-nbd-pluginUpgrade python3-libvirtUpgrade netcf-libsUpgrade nbdkit-tmpdisk-pluginUpgrade libvirt-wiresharkUpgrade qemu-kvm-coreUpgrade nbdkitUpgrade seabios-binUpgrade perl-hivexUpgrade qemu-imgUpgrade libiscsiUpgrade libvirt-adminUpgrade libvirt-daemon-driver-secretUpgrade libvirt-daemon-driver-storage-rbdUpgrade swtpm-tools-pkcs11Upgrade libvirt-develUpgrade qemu-virtiofsdUpgrade libguestfsUpgrade virt-dibUpgrade nbdkit-gzip-filterUpgrade nbdkit-curl-pluginUpgrade swtpmUpgrade libnbdUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-daemon-driver-storage-scsiUpgrade nbdkit-example-pluginsUpgrade qemu-kvm-block-iscsiUpgrade libguestfs-java-develUpgrade nbdkit-linuxdisk-pluginUpgrade libvirt-daemon-driver-storage-iscsi-directUpgrade qemu-block-iscsiUpgrade qemu-system-aarch64-coreUpgrade libguestfs-develUpgrade libguestfs-javaUpgrade qemu-kvm-block-curlUpgrade python3-libnbdUpgrade lua-guestfsUpgrade libvirt-daemon-driver-storage-coreUpgrade libguestfs-inspect-iconsUpgrade seavgabios-binUpgrade nbdkit-tar-pluginUpgrade qemu-kvm-block-glusterUpgrade qemu-commonUpgrade libvirt-daemon-driver-networkUpgrade libvirt-bash-completionUpgrade libguestfs-benchmarkingUpgrade qemu-system-x86-coreUpgrade python3-hivexUpgrade qemu-kvm-block-sshUpgrade netcf-develUpgrade nbdkit-basic-pluginsUpgrade libguestfs-xfsUpgrade libguestfs-gobject-develUpgrade hivexUpgrade ruby-libguestfsUpgrade qemu-block-glusterUpgrade libguestfs-winsupportUpgrade virt-v2vUpgrade sgabiosUpgrade nbdkit-develUpgrade libvirt-daemonUpgrade superminUpgrade qemu-system-aarch64Upgrade swtpm-toolsUpgrade seabiosUpgrade nbdkit-basic-filtersUpgrade perl-Sys-GuestfsUpgrade libvirt-lock-sanlockUpgrade libiscsi-utilsUpgrade libguestfs-toolsUpgrade libguestfs-bash-completionUpgrade nbdkit-gzip-pluginUpgrade qemu-kvm-block-rbdUpgrade virt-v2v-bash-completionUpgrade qemu-block-rbdUpgrade qemuUpgrade supermin-develUpgrade virt-v2v-man-pages-jaUpgrade nbdkit-serverUpgrade libiscsi-develUpgrade libguestfs-rescueUpgrade nbdkit-xz-filterUpgrade libvirtUpgrade libnbd-develUpgrade libvirt-daemon-driver-storage-glusterUpgrade nbdkit-tar-filterUpgrade libvirt-nssUpgrade qemu-kvmUpgrade ivshmem-toolsUpgrade nbdkit-vddk-pluginUpgrade python3-libguestfsUpgrade qemu-guest-agentUpgrade swtpm-libsUpgrade nbdkit-python-pluginUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-clientUpgrade libguestfs-applianceUpgrade libtpmsUpgrade libvirt-daemon-driver-qemuUpgrade libguestfs-javadoc | Jan 24, 2023 | Jul 7, 2021 |
| Suse | — | Upgrade qemu-audio-jackUpgrade qemu-vgabiosUpgrade qemu-hw-usb-redirectUpgrade qemu-vhost-user-gpuUpgrade qemu-s390xUpgrade qemu-chardev-baumUpgrade qemu-audio-dbusUpgrade qemu-block-sshUpgrade qemu-hw-display-qxlUpgrade qemu-block-iscsiUpgrade qemu-ui-spice-appUpgrade qemu-guest-agentUpgrade qemu-slofUpgrade qemu-ui-dbusUpgrade qemu-chardev-spiceUpgrade qemu-audio-spiceUpgrade qemu-ui-spice-coreUpgrade qemu-ppcUpgrade qemu-ui-gtkUpgrade qemu-accel-tcg-x86Upgrade qemu-block-rbdUpgrade qemuUpgrade qemu-ipxeUpgrade qemu-toolsUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-kvmUpgrade qemu-langUpgrade qemu-hw-usb-smartcardUpgrade qemu-block-glusterUpgrade qemu-block-nfsUpgrade qemu-skibootUpgrade qemu-block-dmgUpgrade qemu-s390Upgrade qemu-block-curlUpgrade qemu-audio-paUpgrade qemu-accel-qtestUpgrade qemu-hw-usb-hostUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-ivshmem-toolsUpgrade qemu-ksmUpgrade qemu-microvmUpgrade qemu-seabiosUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-ui-openglUpgrade qemu-sgabiosUpgrade qemu-audio-alsaUpgrade qemu-armUpgrade qemu-x86Upgrade qemu-ui-cursesUpgrade qemu-extra | Aug 9, 2024 | Mar 3, 2022 |
| Ubuntu | — | Upgrade qemu-system-mipsUpgrade qemu-system-sparcUpgrade qemu-system-miscUpgrade qemu-system-xenUpgrade qemu-systemUpgrade qemu-system-ppcUpgrade qemu-system-x86-xenUpgrade qemu-system-s390xUpgrade qemu-system-x86Upgrade qemu-system-x86-microvmUpgrade qemu-system-armUpgrade qemu | Jan 9, 2024 | Mar 3, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub