Skip to content
OpenAdvisories
Medium USN-6167-1 4 CVEs

qemu vulnerabilities

Published Jun 19, 2023 · Updated Jun 29, 2026

Summary

It was discovered that QEMU did not properly manage the guest drivers when
shared buffers are not allocated. A malicious guest driver could use this
issue to cause QEMU to crash, resulting in a denial of service, or possibly
execute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu
22.04 LTS and Ubuntu 22.10. (CVE-2022-1050)

It was discovered that QEMU did not properly check the size of the
structure pointed to by the guest physical address pqxl. A malicious guest
attacker could use this issue to cause QEMU to crash, resulting in a denial
of service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS,
Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 22.10.
(CVE-2022-4144)

It was discovered that QEMU did not properly manage memory in the ACPI
Error Record Serialization Table (ERST) device. A malicious guest attacker
could use this issue to cause QEMU to crash, resulting in a denial of
service. This issue only affected Ubuntu 22.10. (CVE-2022-4172)

It was discovered that QEMU did not properly manage memory when DMA memory
writes happen repeatedly in the lsi53c895a device. A malicious guest
attacker could use this issue to cause QEMU to crash, resulting in a denial
of service. (CVE-2023-0330)

Fixed packages 5

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS qemu 1:4.2-3ubuntu6.27
Ubuntu · 22.04 LTS 22.04:LTS qemu 1:6.2+dfsg-2ubuntu6.11
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS qemu 2.0.0+dfsg-2ubuntu1.47+esm3
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS qemu 1:2.5+dfsg-5ubuntu10.51+esm2
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS qemu 1:2.11+dfsg-1ubuntu7.42+esm1

Vulnerabilities 4

References

  • report
    https://ubuntu.com/security/CVE-2022-1050
  • report
    https://ubuntu.com/security/CVE-2022-4144
  • report
    https://ubuntu.com/security/CVE-2022-4172
  • report
    https://ubuntu.com/security/CVE-2023-0330