A stack-buffer-overflow was found in QEMU in the NVME component. The flaw lies in nvme_changed_nslist() where a malicious guest controlling certain input can read out of bounds memory. A malicious user could use this flaw leading to disclosure of sensitive information.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qemu | Oct 1, 2024 | Feb 18, 2022 |
| Debian | — | Upgrade qemu | Jul 30, 2024 | Feb 18, 2022 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Aug 16, 2022 | Feb 18, 2022 |
| Oracle_linux | — | Upgrade sgabios-binUpgrade netcf-libsUpgrade python3-hivexUpgrade qemu-block-iscsiUpgrade supermin-develUpgrade libiscsi-utilsUpgrade libvirt-daemonUpgrade libguestfs-xfsUpgrade libvirt-daemon-driver-networkUpgrade qemu-system-x86Upgrade python3-libguestfsUpgrade python3-libnbdUpgrade qemu-kvm-block-glusterUpgrade qemu-kvm-block-sshUpgrade qemu-imgUpgrade netcf-develUpgrade libiscsiUpgrade libguestfs-inspect-iconsUpgrade libguestfsUpgrade libvirt-clientUpgrade libvirtUpgrade sgabiosUpgrade ruby-hivexUpgrade qemu-system-aarch64Upgrade nbdkit-serverUpgrade libvirt-lock-sanlockUpgrade nbdkit-gzip-pluginUpgrade libvirt-docsUpgrade libvirt-daemon-driver-storage-coreUpgrade libvirt-daemon-driver-interfaceUpgrade libvirt-daemon-driver-nodedevUpgrade libguestfs-winsupportUpgrade seabiosUpgrade libvirt-nssUpgrade libvirt-daemon-driver-storage-logicalUpgrade libvirt-daemon-driver-storage-glusterUpgrade libvirt-daemon-driver-qemuUpgrade nbdkit-vddk-pluginUpgrade libguestfs-bash-completionUpgrade qemu-guest-agentUpgrade perl-Sys-GuestfsUpgrade libvirt-daemon-driver-storage-iscsiUpgrade libvirt-daemon-driver-storage-diskUpgrade libguestfs-gobjectUpgrade nbdkit-python-pluginUpgrade nbdkit-develUpgrade seavgabios-binUpgrade nbdkit-curl-pluginUpgrade qemuUpgrade ruby-libguestfsUpgrade nbdkit-linuxdisk-pluginUpgrade libguestfs-rescueUpgrade qemu-kvm-coreUpgrade qemu-kvm-block-rbdUpgrade libguestfs-gobject-develUpgrade hivexUpgrade nbdkit-basic-filtersUpgrade nbdkit-basic-pluginsUpgrade lua-guestfsUpgrade libvirt-daemon-driver-storage-scsiUpgrade perl-hivexUpgrade libvirt-daemon-config-networkUpgrade libvirt-daemon-driver-storage-mpathUpgrade libvirt-daemon-kvmUpgrade libvirt-libsUpgrade libguestfs-gfs2Upgrade nbdkit-bash-completionUpgrade python3-libvirtUpgrade qemu-system-aarch64-core | Feb 5, 2022 | Nov 10, 2021 |
| Ubuntu | ubuntu-upgrade-qemu | Nov 19, 2024 | Feb 18, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub