85 results · Feed
-
Medium 6.0
Qemu: 9pfs: improper access control on special files
A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. The 9pfs server did not prohibit opening special files on the host side, potentially allowing a malicious client to escape from the exported 9p tree by creating and opening a dev…
-
Medium 5.3
Qemu: lsi53c895a: dma reentrancy issue leads to stack overflow
A vulnerability in the lsi53c895a device affects the latest version of qemu. A DMA-MMIO reentrancy problem may lead to memory corruption bugs like stack overflow or use-after-free.
-
Medium 6.5
An integer underflow issue was found in the QEMU VNC server while processing ClientCutText messages in the extended for…
-
High 7.8
A DMA reentrancy issue was found in the Tulip device emulation in QEMU. When Tulip reads or writes to the rx/tx descrip…
-
Unscored —
A NULL pointer dereference issue was found in the ACPI code of QEMU. A malicious, privileged user within the guest coul…
-
Unscored —
An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx…
-
Unscored —
A stack-buffer-overflow was found in QEMU in the NVME component. The flaw lies in nvme_changed_nslist() where a malicio…
-
Unscored —
An off-by-one error was found in the SCSI device emulation in QEMU. It could occur while processing MODE SELECT command…
-
Unscored —
An incorrect default permissions vulnerability was found in the mig-controller. Due to an incorrect cluster namespaces …
-
Unscored —
An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.…
-
Unscored —
A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs when dropping…
-
Unscored —
A divide-by-zero issue was found in dwc2_handle_packet in hw/usb/hcd-dwc2.c in the hcd-dwc2 USB host controller emulati…
-
Unscored —
An out-of-bounds write vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions…
-
Unscored —
An information disclosure vulnerability was found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versi…
-
Unscored —
Several memory leaks were found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and incl…
-
Unscored —
A NULL pointer dereference flaw was found in the megasas-gen2 SCSI host bus adapter emulation of QEMU in versions befor…
-
Unscored —
A use-after-free vulnerability was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0…
-
Unscored —
A NULL pointer dereference flaw was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.…
-
Unscored —
A NULL pointer dereference flaw was found in the SCSI emulation support of QEMU in versions before 6.0.0. This flaw all…
-
Unscored —
A NULL pointer dereference flaw was found in the floppy disk emulator of QEMU. This issue occurs while processing read/…
-
Unscored —
A flaw was found in the USB redirector device (usb-redir) of QEMU. Small USB packets are combined into a single, large …
-
Unscored —
An out-of-bounds heap buffer access issue was found in the ARM Generic Interrupt Controller emulator of QEMU up to and …
-
Unscored —
A race condition flaw was found in the 9pfs server implementation of QEMU up to and including 5.2.0. This flaw allows a…
-
Unscored —
A heap buffer overflow was found in the floppy disk emulator of QEMU up to 6.0.0 (including). It could occur in fdctrl_…
-
Unscored —
The patch for CVE-2020-17380/CVE-2020-25085 was found to be ineffective, thus making QEMU vulnerable to the out-of-boun…
-
Unscored —
A use-after-free flaw was found in the MegaRAID emulator of QEMU. This issue occurs while processing SCSI I/O requests …
-
Unscored —
A potential stack overflow via infinite loop issue was found in various NIC emulators of QEMU in versions up to and inc…
-
Unscored —
A stack overflow via an infinite recursion vulnerability was found in the eepro100 i8255x device emulator of QEMU. This…
-
Unscored —
An integer overflow issue was found in the vmxnet3 NIC emulator of the QEMU for versions up to v5.2.0. It may occur if …
-
Unscored —
A heap-based buffer overflow was found in QEMU through 5.0.0 in the SDHCI device emulation support. It could occur whil…
-
Unscored —
A flaw was found in qemu. A host privilege escalation issue was found in the virtio-fs shared file system daemon where …
-
Unscored —
ide_atapi_cmd_reply_end in hw/ide/atapi.c in QEMU 5.1.0 allows out-of-bounds read access because a buffer index is not …
-
Unscored —
A flaw was found in the memory management API of QEMU during the initialization of a memory region cache. This issue co…
-
Unscored —
hw/net/e1000e_core.c in QEMU 5.0.0 has an infinite loop via an RX descriptor with a NULL buffer address.
-
Unscored —
A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB reque…
-
Unscored —
hw/usb/hcd-ohci.c in QEMU 5.0.0 has a stack-based buffer over-read via values obtained from the host controller driver.
-
Unscored —
eth_get_gso_type in net/eth.c in QEMU 4.2.1 allows guest OS users to trigger an assertion failure. A guest can crash th…
-
Unscored —
ati_2d_blt in hw/display/ati_2d.c in QEMU 4.2.1 can encounter an outside-limits situation in a calculation. A guest can…
-
Unscored —
An issue was discovered in QEMU through 5.1.0. An out-of-bounds memory access was found in the ATI VGA device implement…
-
Unscored —
pci_change_irq_level in hw/pci/pci.c in QEMU before 5.1.1 has a NULL pointer dereference because pci_get_bus() might no…