An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-bounds access to the UASDevice->data3 and UASDevice->status3 fields. A malicious guest user could use this flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the host.
CVSS Details
- CVSS 3.1 Base Score: 7.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qemu | Oct 1, 2024 | Aug 25, 2021 |
| Debian | — | Upgrade qemu | Sep 7, 2021 | Aug 25, 2021 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Aug 16, 2022 | Aug 25, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade qemu-img | Jan 28, 2022 | Aug 25, 2021 |
| Oracle_linux | — | Upgrade nbdkit-example-pluginsUpgrade libvirt-develUpgrade libiscsi-develUpgrade qemu-kvmUpgrade libguestfs-winsupportUpgrade netcf-develUpgrade qemu-system-x86-coreUpgrade qemu-imgUpgrade qemu-kvm-commonUpgrade qemu-system-aarch64Upgrade libvirt-daemon-driver-storage-glusterUpgrade libvirt-clientUpgrade python3-libvirtUpgrade qemu-block-rbdUpgrade seavgabios-binUpgrade netcfUpgrade libguestfsUpgrade qemu-kvm-block-glusterUpgrade libguestfs-inspect-iconsUpgrade libguestfs-gobject-develUpgrade hivex-develUpgrade libguestfs-javadocUpgrade libvirtUpgrade libiscsiUpgrade seabiosUpgrade libvirt-daemon-driver-storage-logicalUpgrade libvirt-nssUpgrade libvirt-bash-completionUpgrade netcf-libsUpgrade libvirt-daemon-driver-networkUpgrade nbdkit-develUpgrade libguestfs-benchmarkingUpgrade seabios-binUpgrade supermin-develUpgrade nbdkit-linuxdisk-pluginUpgrade qemu-commonUpgrade virt-v2vUpgrade libguestfs-bash-completionUpgrade libvirt-daemon-config-networkUpgrade libvirt-daemon-driver-secretUpgrade perl-hivexUpgrade nbdfuseUpgrade libiscsi-utilsUpgrade libvirt-daemon-driver-qemuUpgrade libguestfs-man-pages-ukUpgrade libvirt-daemon-driver-nwfilterUpgrade python3-libnbdUpgrade libvirt-adminUpgrade libvirt-daemon-driver-storage-diskUpgrade libvirt-daemon-kvmUpgrade lua-guestfsUpgrade nbdkit-xz-filterUpgrade libguestfs-tools-cUpgrade libvirt-daemon-driver-storage-mpathUpgrade libvirt-daemon-driver-storage-coreUpgrade nbdkit-ssh-pluginUpgrade libguestfs-xfsUpgrade superminUpgrade libvirt-daemon-driver-storage-scsiUpgrade nbdkit-curl-pluginUpgrade nbdkitUpgrade libnbd-develUpgrade nbdkit-python-pluginUpgrade libvirt-dbusUpgrade libguestfs-toolsUpgrade libguestfs-gfs2Upgrade ruby-libguestfsUpgrade qemuUpgrade qemu-guest-agentUpgrade qemu-system-aarch64-coreUpgrade qemu-kvm-block-rbdUpgrade nbdkit-serverUpgrade nbdkit-bash-completionUpgrade libvirt-daemon-config-nwfilterUpgrade libguestfs-rescueUpgrade qemu-block-glusterUpgrade qemu-kvm-block-iscsiUpgrade qemu-kvm-coreUpgrade libvirt-daemon-driver-nodedevUpgrade perl-Sys-GuestfsUpgrade libnbdUpgrade libguestfs-develUpgrade qemu-system-x86Upgrade qemu-kvm-block-sshUpgrade libvirt-daemonUpgrade libguestfs-java-develUpgrade libguestfs-javaUpgrade libguestfs-man-pages-jaUpgrade libvirt-daemon-driver-storageUpgrade sgabios-binUpgrade libguestfs-rsyncUpgrade perl-Sys-VirtUpgrade nbdkit-basic-pluginsUpgrade libvirt-daemon-driver-storage-rbdUpgrade libvirt-daemon-driver-interfaceUpgrade libguestfs-gobjectUpgrade hivexUpgrade libvirt-daemon-driver-storage-iscsiUpgrade python3-hivexUpgrade libvirt-lock-sanlockUpgrade virt-dibUpgrade ruby-hivexUpgrade nbdkit-gzip-pluginUpgrade libvirt-libsUpgrade qemu-kvm-block-curlUpgrade libvirt-docsUpgrade python3-libguestfsUpgrade qemu-block-iscsiUpgrade libvirt-daemon-driver-storage-iscsi-directUpgrade sgabiosUpgrade nbdkit-vddk-pluginUpgrade nbdkit-basic-filters | Jan 4, 2022 | Aug 17, 2021 |
| Suse | — | Upgrade qemu-audio-sdlUpgrade qemu-chardev-baumUpgrade qemu-block-dmgUpgrade qemu-ui-cursesUpgrade qemu-hw-usb-hostUpgrade qemu-skibootUpgrade qemu-ui-openglUpgrade qemu-ui-sdlUpgrade qemu-microvmUpgrade qemu-ksmUpgrade qemu-s390Upgrade qemu-hw-display-virtio-vgaUpgrade qemu-audio-ossUpgrade qemu-extraUpgrade qemu-block-curlUpgrade qemu-sgabiosUpgrade qemu-x86Upgrade qemu-linux-userUpgrade qemu-audio-alsaUpgrade qemu-testsuiteUpgrade qemu-armUpgrade qemu-seabiosUpgrade qemu-ivshmem-toolsUpgrade qemu-kvmUpgrade qemuUpgrade qemu-hw-display-qxlUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-ui-gtkUpgrade qemu-audio-paUpgrade qemu-hw-usb-smartcardUpgrade qemu-block-rbdUpgrade qemu-guest-agentUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-block-glusterUpgrade qemu-s390xUpgrade qemu-vhost-user-gpuUpgrade qemu-ui-spice-coreUpgrade qemu-chardev-spiceUpgrade qemu-langUpgrade qemu-block-sshUpgrade qemu-ui-spice-appUpgrade qemu-vgabiosUpgrade qemu-hw-usb-redirectUpgrade qemu-slofUpgrade qemu-toolsUpgrade qemu-ppcUpgrade qemu-accel-tcg-x86Upgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-block-iscsiUpgrade qemu-block-nfsUpgrade qemu-audio-spiceUpgrade qemu-ipxe | Oct 27, 2021 | Aug 25, 2021 |
| Ubuntu | — | Upgrade qemu-system-x86-xenUpgrade qemu-system-s390xUpgrade qemu-system-ppcUpgrade qemu-system-x86Upgrade qemu-system-armUpgrade qemu-system-x86-microvmUpgrade qemu-system-mipsUpgrade qemu-systemUpgrade qemu-system-miscUpgrade qemu-system-sparc | Mar 22, 2023 | Aug 25, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub