QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the length of the available FIFO data. This occurs in esp_do_nodma in hw/scsi/esp.c because of an underflow of async_len.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu | Jul 30, 2024 | Feb 20, 2024 |
| Oracle_linux | — | Upgrade libguestfs-toolsUpgrade virt-v2v-bash-completionUpgrade libvirt-daemon-driver-storage-coreUpgrade qemu-kvm-block-rbdUpgrade libvirt-libsUpgrade nbdkit-basic-pluginsUpgrade swtpmUpgrade libguestfs-java-develUpgrade libvirt-daemon-driver-storage-mpathUpgrade libvirt-lock-sanlockUpgrade nbdkit-tar-filterUpgrade perl-Sys-VirtUpgrade nbdkit-serverUpgrade ruby-libguestfsUpgrade libvirt-daemon-config-nwfilterUpgrade libvirt-daemon-driver-storage-rbdUpgrade sgabiosUpgrade libguestfs-applianceUpgrade swtpm-libsUpgrade superminUpgrade qemu-kvm-coreUpgrade libguestfs-bash-completionUpgrade libiscsiUpgrade nbdkit-nbd-pluginUpgrade libvirt-client-qemuUpgrade libguestfs-rsyncUpgrade virt-v2v-man-pages-ukUpgrade nbdkitUpgrade libguestfs-tools-cUpgrade libguestfs-gfs2Upgrade libvirt-daemon-driver-storage-scsiUpgrade nbdkit-python-pluginUpgrade libvirt-daemon-driver-nodedevUpgrade nbdkit-basic-filtersUpgrade python3-libguestfsUpgrade libguestfs-xfsUpgrade sgabios-binUpgrade hivexUpgrade libguestfs-develUpgrade qemu-imgUpgrade libguestfs-rescueUpgrade qemu-kvm-block-curlUpgrade nbdkit-linuxdisk-pluginUpgrade qemu-guest-agentUpgrade libtpms-develUpgrade libvirtUpgrade qemu-kvm-block-iscsiUpgrade nbdkit-bash-completionUpgrade nbdkit-vddk-pluginUpgrade nbdkit-curl-pluginUpgrade libnbdUpgrade libnbd-develUpgrade nbdkit-tmpdisk-pluginUpgrade nbdkit-gzip-pluginUpgrade libvirt-daemon-driver-storage-iscsiUpgrade libvirt-daemon-driver-storage-iscsi-directUpgrade qemu-kvm-block-sshUpgrade libguestfs-man-pages-jaUpgrade libguestfs-gobjectUpgrade nbdkit-gzip-filterUpgrade perl-Sys-GuestfsUpgrade python3-hivexUpgrade libguestfs-winsupportUpgrade netcf-libsUpgrade hivex-develUpgrade qemu-kvmUpgrade libvirt-docsUpgrade nbdkit-example-pluginsUpgrade libnbd-bash-completionUpgrade nbdkit-develUpgrade libguestfs-inspect-iconsUpgrade netcf-develUpgrade libvirt-daemon-driver-secretUpgrade supermin-develUpgrade seavgabios-binUpgrade libvirt-daemon-driver-networkUpgrade libtpmsUpgrade libguestfs-man-pages-ukUpgrade libguestfsUpgrade virt-v2vUpgrade swtpm-develUpgrade libvirt-daemon-driver-qemuUpgrade virt-v2v-man-pages-jaUpgrade qemu-kvm-commonUpgrade libvirt-nssUpgrade libvirt-dbusUpgrade libvirt-daemon-driver-storage-diskUpgrade virt-dibUpgrade swtpm-tools-pkcs11Upgrade perl-hivexUpgrade libvirt-daemon-driver-storageUpgrade libiscsi-utilsUpgrade libguestfs-gobject-develUpgrade qemu-virtiofsdUpgrade seabios-binUpgrade ruby-hivexUpgrade python3-libnbdUpgrade nbdkit-ssh-pluginUpgrade lua-guestfsUpgrade libvirt-daemon-kvmUpgrade libvirt-daemon-driver-storage-glusterUpgrade libvirt-daemon-driver-nwfilterUpgrade libguestfs-javadocUpgrade seabiosUpgrade libvirt-clientUpgrade libguestfs-javaUpgrade swtpm-toolsUpgrade qemu-kvm-block-glusterUpgrade python3-libvirtUpgrade libvirt-wiresharkUpgrade libvirt-daemon-driver-storage-logicalUpgrade libvirt-daemon-config-networkUpgrade libiscsi-develUpgrade libvirt-develUpgrade nbdkit-xz-filterUpgrade nbdkit-tar-pluginUpgrade libvirt-daemon-driver-interfaceUpgrade netcfUpgrade nbdfuseUpgrade libvirt-daemon | Apr 11, 2024 | Feb 20, 2024 |
| Suse | — | Upgrade qemuUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-armUpgrade qemu-audio-paUpgrade qemu-guest-agentUpgrade qemu-audio-dbusUpgrade qemu-langUpgrade qemu-chardev-spiceUpgrade qemu-block-dmgUpgrade qemu-ui-cursesUpgrade qemu-ppcUpgrade qemu-ivshmem-toolsUpgrade qemu-block-nfsUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-ipxeUpgrade qemu-ui-spice-appUpgrade qemu-toolsUpgrade qemu-skibootUpgrade qemu-ui-openglUpgrade qemu-block-glusterUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-block-sshUpgrade qemu-hw-display-qxlUpgrade qemu-vhost-user-gpuUpgrade qemu-block-rbdUpgrade qemu-block-curlUpgrade qemu-extraUpgrade qemu-hw-usb-redirectUpgrade qemu-x86Upgrade qemu-ui-dbusUpgrade qemu-block-iscsiUpgrade qemu-kvmUpgrade qemu-ui-gtkUpgrade qemu-hw-usb-hostUpgrade qemu-hw-usb-smartcardUpgrade qemu-vgabiosUpgrade qemu-ksmUpgrade qemu-accel-qtestUpgrade qemu-ui-spice-coreUpgrade qemu-audio-alsaUpgrade qemu-SLOFUpgrade qemu-audio-jackUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-audio-spiceUpgrade qemu-seabiosUpgrade qemu-chardev-baumUpgrade qemu-microvmUpgrade qemu-sgabiosUpgrade qemu-s390xUpgrade qemu-accel-tcg-x86 | Apr 4, 2024 | Feb 20, 2024 |
| Ubuntu | — | Upgrade qemu-system-ppcUpgrade qemu-systemUpgrade qemu-system-mipsUpgrade qemu-system-sparcUpgrade qemu-system-armUpgrade qemu-system-x86-xenUpgrade qemu-system-s390xUpgrade qemu-system-misc | Aug 14, 2024 | Feb 20, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub