A DMA reentrancy issue was found in the Tulip device emulation in QEMU. When Tulip reads or writes to the rx/tx descriptor or copies the rx/tx frame, it doesn't check whether the destination address is its own MMIO address. This can cause the device to trigger MMIO handlers multiple times, possibly leading to a stack or heap overflow. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qemu | Aug 22, 2024 | Sep 13, 2022 |
| Debian | — | Upgrade qemu | Jul 30, 2024 | Sep 13, 2022 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Aug 12, 2024 | Sep 13, 2022 |
| Suse | — | Upgrade qemu-tools | Jun 13, 2023 | Sep 13, 2022 |
| Ubuntu | — | Upgrade qemu-system-armUpgrade qemu-system-miscUpgrade qemu-system-misc (Ubuntu Pro)Upgrade qemu-system-x86-microvmUpgrade qemuUpgrade qemu-system-x86-xenUpgrade qemu-system-ppc (Ubuntu Pro)Upgrade qemu-system-s390xUpgrade qemu-system-s390x (Ubuntu Pro)Upgrade qemu-system-sparcUpgrade qemu-system (Ubuntu Pro)Upgrade qemu-system-arm (Ubuntu Pro)Upgrade qemu-system-mips (Ubuntu Pro)Upgrade qemu-system-mipsUpgrade qemu-system-x86Upgrade qemu-system-aarch64 (Ubuntu Pro)Upgrade qemu-systemUpgrade qemu-system-sparc (Ubuntu Pro)Upgrade qemu-system-x86 (Ubuntu Pro)Upgrade qemu-system-ppc | Dec 12, 2022 | Sep 13, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub