An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-bounds access to the UASDevice->data3 and UASDevice->status3 fields. A malicious guest user could use this flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the host.
CVSS Details
- CVSS 3.1 Base Score: 7.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qemu | Oct 1, 2024 | Aug 25, 2021 |
| Debian | — | Upgrade qemu | Sep 7, 2021 | Aug 25, 2021 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Aug 16, 2022 | Aug 25, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade qemu-img | Jan 28, 2022 | Aug 25, 2021 |
| Oracle_linux | — | Upgrade libvirt-daemon-driver-nwfilterUpgrade libguestfs-man-pages-ukUpgrade libvirt-daemon-driver-storage-diskUpgrade nbdfuseUpgrade libvirt-clientUpgrade libvirt-daemon-driver-qemuUpgrade seavgabios-binUpgrade qemu-kvm-commonUpgrade qemu-block-rbdUpgrade libvirt-daemon-driver-storage-glusterUpgrade python3-libvirtUpgrade qemu-system-x86-coreUpgrade libiscsi-utilsUpgrade python3-libnbdUpgrade qemu-imgUpgrade nbdkit-example-pluginsUpgrade nbdkit-linuxdisk-pluginUpgrade qemu-commonUpgrade virt-v2vUpgrade libguestfs-bash-completionUpgrade libvirt-daemon-config-networkUpgrade libvirt-daemon-driver-storage-logicalUpgrade nbdkit-xz-filterUpgrade libvirt-nssUpgrade libguestfs-benchmarkingUpgrade seabios-binUpgrade nbdkit-develUpgrade netcf-develUpgrade qemu-kvm-block-glusterUpgrade supermin-develUpgrade netcf-libsUpgrade libguestfsUpgrade libguestfs-inspect-iconsUpgrade libvirt-daemon-driver-secretUpgrade netcfUpgrade libiscsi-develUpgrade libvirt-daemon-driver-networkUpgrade perl-hivexUpgrade libvirt-adminUpgrade libvirt-daemon-kvmUpgrade qemu-system-aarch64Upgrade libvirt-develUpgrade hivex-develUpgrade libguestfs-javadocUpgrade libguestfs-gobject-develUpgrade lua-guestfsUpgrade libiscsiUpgrade libguestfs-winsupportUpgrade libvirtUpgrade libvirt-bash-completionUpgrade qemu-kvmUpgrade seabiosUpgrade nbdkit-basic-pluginsUpgrade nbdkit-python-pluginUpgrade libvirt-daemon-driver-interfaceUpgrade libguestfs-java-develUpgrade qemu-kvm-block-sshUpgrade libvirt-daemonUpgrade libguestfs-javaUpgrade libguestfs-develUpgrade python3-hivexUpgrade perl-Sys-VirtUpgrade nbdkit-serverUpgrade nbdkit-bash-completionUpgrade libvirt-dbusUpgrade libguestfs-toolsUpgrade qemu-system-aarch64-coreUpgrade qemu-guest-agentUpgrade qemu-kvm-block-rbdUpgrade libguestfs-gfs2Upgrade ruby-libguestfsUpgrade qemuUpgrade qemu-kvm-coreUpgrade qemu-kvm-block-iscsiUpgrade libguestfs-rescueUpgrade qemu-block-glusterUpgrade libvirt-daemon-driver-nodedevUpgrade libvirt-daemon-config-nwfilterUpgrade perl-Sys-GuestfsUpgrade libguestfs-rsyncUpgrade sgabios-binUpgrade python3-libguestfsUpgrade nbdkit-ssh-pluginUpgrade libnbd-develUpgrade libguestfs-xfsUpgrade nbdkit-basic-filtersUpgrade libvirt-daemon-driver-storage-mpathUpgrade nbdkit-curl-pluginUpgrade virt-dibUpgrade nbdkit-gzip-pluginUpgrade sgabiosUpgrade nbdkit-vddk-pluginUpgrade libvirt-daemon-driver-storage-iscsi-directUpgrade libguestfs-man-pages-jaUpgrade libvirt-daemon-driver-storage-coreUpgrade libvirt-lock-sanlockUpgrade ruby-hivexUpgrade qemu-kvm-block-curlUpgrade libvirt-daemon-driver-storage-scsiUpgrade nbdkitUpgrade libguestfs-tools-cUpgrade superminUpgrade libvirt-libsUpgrade libvirt-daemon-driver-storageUpgrade qemu-block-iscsiUpgrade libvirt-docsUpgrade qemu-system-x86Upgrade libnbdUpgrade libvirt-daemon-driver-storage-rbdUpgrade libvirt-daemon-driver-storage-iscsiUpgrade hivexUpgrade libguestfs-gobject | Jan 4, 2022 | Aug 17, 2021 |
| Suse | — | Upgrade qemu-testsuiteUpgrade qemu-x86Upgrade qemu-armUpgrade qemu-sgabiosUpgrade qemu-seabiosUpgrade qemu-block-curlUpgrade qemu-ui-sdlUpgrade qemu-chardev-baumUpgrade qemu-skibootUpgrade qemu-ui-openglUpgrade qemu-extraUpgrade qemu-hw-usb-hostUpgrade qemu-audio-alsaUpgrade qemu-ui-cursesUpgrade qemu-s390Upgrade qemu-block-dmgUpgrade qemu-microvmUpgrade qemu-linux-userUpgrade qemu-ksmUpgrade qemu-audio-sdlUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-audio-ossUpgrade qemu-block-iscsiUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-vhost-user-gpuUpgrade qemu-ui-spice-coreUpgrade qemu-ui-spice-appUpgrade qemu-langUpgrade qemu-hw-usb-redirectUpgrade qemu-ui-gtkUpgrade qemu-ivshmem-toolsUpgrade qemu-block-rbdUpgrade qemu-slofUpgrade qemu-block-nfsUpgrade qemu-block-glusterUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-kvmUpgrade qemu-s390xUpgrade qemu-ppcUpgrade qemu-toolsUpgrade qemu-accel-tcg-x86Upgrade qemu-guest-agentUpgrade qemu-hw-usb-smartcardUpgrade qemu-audio-paUpgrade qemu-block-sshUpgrade qemu-chardev-spiceUpgrade qemuUpgrade qemu-audio-spiceUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-ipxeUpgrade qemu-hw-display-qxlUpgrade qemu-vgabios | Oct 27, 2021 | Aug 25, 2021 |
| Ubuntu | — | Upgrade qemu-system-s390xUpgrade qemu-system-x86Upgrade qemu-system-ppcUpgrade qemu-system-armUpgrade qemu-system-x86-xenUpgrade qemu-system-x86-microvmUpgrade qemu-system-sparcUpgrade qemu-systemUpgrade qemu-system-mipsUpgrade qemu-system-misc | Mar 22, 2023 | Aug 25, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub