An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-bounds access to the UASDevice->data3 and UASDevice->status3 fields. A malicious guest user could use this flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the host.
CVSS Details
- CVSS 3.1 Base Score: 7.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:P/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qemu | Oct 1, 2024 | Aug 25, 2021 |
| Debian | — | Upgrade qemu | Sep 7, 2021 | Aug 25, 2021 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Aug 16, 2022 | Aug 25, 2021 |
| Huawei Euleros 2_0_sp9 | — | Upgrade qemu-img | Jan 28, 2022 | Aug 25, 2021 |
| Oracle_linux | — | Upgrade libguestfs-man-pages-jaUpgrade libvirt-daemonUpgrade libguestfs-gobjectUpgrade qemu-guest-agentUpgrade libvirt-daemon-driver-storageUpgrade libguestfs-toolsUpgrade libvirt-dbusUpgrade nbdkit-bash-completionUpgrade ruby-libguestfsUpgrade qemu-system-aarch64-coreUpgrade qemuUpgrade libvirt-daemon-driver-storage-iscsi-directUpgrade qemu-kvm-block-rbdUpgrade libvirt-docsUpgrade libvirt-daemon-driver-storage-iscsiUpgrade libvirt-daemon-driver-storage-rbdUpgrade qemu-kvm-coreUpgrade qemu-block-glusterUpgrade sgabiosUpgrade hivexUpgrade nbdkit-vddk-pluginUpgrade libvirt-daemon-driver-interfaceUpgrade perl-Sys-VirtUpgrade python3-hivexUpgrade libguestfs-javaUpgrade qemu-kvm-block-iscsiUpgrade libguestfs-gfs2Upgrade libguestfs-develUpgrade qemu-block-iscsiUpgrade nbdkit-serverUpgrade libnbdUpgrade libvirt-libsUpgrade nbdkit-python-pluginUpgrade qemu-kvm-block-sshUpgrade libguestfs-rescueUpgrade libvirt-daemon-driver-nodedevUpgrade libguestfs-java-develUpgrade perl-Sys-GuestfsUpgrade virt-dibUpgrade libvirt-lock-sanlockUpgrade nbdkit-gzip-pluginUpgrade qemu-kvm-block-curlUpgrade qemu-system-x86Upgrade nbdkit-basic-pluginsUpgrade ruby-hivexUpgrade libvirt-daemon-config-nwfilterUpgrade nbdkit-curl-pluginUpgrade superminUpgrade libguestfs-tools-cUpgrade nbdkit-basic-filtersUpgrade nbdkit-ssh-pluginUpgrade libguestfs-xfsUpgrade python3-libguestfsUpgrade libnbd-develUpgrade libguestfs-rsyncUpgrade sgabios-binUpgrade libvirt-daemon-driver-storage-scsiUpgrade libvirt-daemon-driver-storage-coreUpgrade libvirt-daemon-driver-storage-mpathUpgrade nbdkitUpgrade seabiosUpgrade libiscsiUpgrade libvirt-daemon-kvmUpgrade nbdkit-xz-filterUpgrade libvirt-daemon-driver-storage-diskUpgrade nbdkit-example-pluginsUpgrade qemu-imgUpgrade python3-libnbdUpgrade qemu-kvm-commonUpgrade libvirt-daemon-driver-nwfilterUpgrade qemu-system-x86-coreUpgrade supermin-develUpgrade seabios-binUpgrade nbdkit-develUpgrade libvirt-nssUpgrade libvirt-daemon-driver-storage-logicalUpgrade libguestfs-benchmarkingUpgrade netcf-libsUpgrade libvirt-daemon-driver-networkUpgrade libvirt-develUpgrade libvirtUpgrade libguestfs-javadocUpgrade hivex-develUpgrade libguestfs-winsupportUpgrade libguestfs-man-pages-ukUpgrade netcf-develUpgrade libiscsi-develUpgrade libguestfsUpgrade netcfUpgrade libguestfs-inspect-iconsUpgrade qemu-kvmUpgrade libvirt-bash-completionUpgrade libvirt-daemon-driver-secretUpgrade libguestfs-gobject-develUpgrade seavgabios-binUpgrade libvirt-daemon-driver-storage-glusterUpgrade qemu-system-aarch64Upgrade libvirt-daemon-config-networkUpgrade libguestfs-bash-completionUpgrade qemu-commonUpgrade nbdfuseUpgrade nbdkit-linuxdisk-pluginUpgrade virt-v2vUpgrade qemu-kvm-block-glusterUpgrade qemu-block-rbdUpgrade python3-libvirtUpgrade libvirt-clientUpgrade perl-hivexUpgrade lua-guestfsUpgrade libvirt-daemon-driver-qemuUpgrade libiscsi-utilsUpgrade libvirt-admin | Jan 4, 2022 | Aug 17, 2021 |
| Suse | — | Upgrade qemu-ksmUpgrade qemu-audio-ossUpgrade qemu-ui-cursesUpgrade qemu-s390Upgrade qemu-SLOFUpgrade qemu-sgabiosUpgrade qemu-testsuiteUpgrade qemu-block-dmgUpgrade qemu-hw-usb-hostUpgrade qemu-audio-alsaUpgrade qemu-x86Upgrade qemu-audio-sdlUpgrade qemu-ui-sdlUpgrade qemu-chardev-baumUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-armUpgrade qemu-skibootUpgrade qemu-seabiosUpgrade qemu-block-curlUpgrade qemu-ui-openglUpgrade qemu-extraUpgrade qemu-microvmUpgrade qemu-linux-userUpgrade qemu-block-sshUpgrade qemu-hw-usb-redirectUpgrade qemu-block-glusterUpgrade qemu-guest-agentUpgrade qemu-audio-paUpgrade qemu-ui-gtkUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-hw-usb-smartcardUpgrade qemu-block-rbdUpgrade qemu-ui-spice-appUpgrade qemu-ivshmem-toolsUpgrade qemu-vgabiosUpgrade qemu-hw-display-qxlUpgrade qemu-block-iscsiUpgrade qemu-audio-spiceUpgrade qemu-block-nfsUpgrade qemu-ipxeUpgrade qemu-ppcUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemuUpgrade qemu-vhost-user-gpuUpgrade qemu-chardev-spiceUpgrade qemu-ui-spice-coreUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-kvmUpgrade qemu-s390xUpgrade qemu-toolsUpgrade qemu-accel-tcg-x86Upgrade qemu-lang | Oct 27, 2021 | Aug 25, 2021 |
| Ubuntu | — | Upgrade qemu-systemUpgrade qemu-system-mipsUpgrade qemu-system-sparcUpgrade qemu-system-miscUpgrade qemu-system-s390xUpgrade qemu-system-x86-xenUpgrade qemu-system-x86-microvmUpgrade qemu-system-x86Upgrade qemu-system-armUpgrade qemu-system-ppc | Mar 22, 2023 | Aug 25, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub