77 results · Feed
-
Medium 4.9
Qemu: virtio-net: stack buffer overflow in virtio_net_flush_tx()
A stack based buffer overflow was found in the virtio-net device of QEMU. This issue occurs when flushing TX in the virtio_net_flush_tx function if guest features VIRTIO_NET_F_HASH_REPORT, VIRTIO_F_VERSION_1 and VIRTIO_NET_F_MRG_RXBUF are enabled. This could …
-
Medium 6.0
Qemu: 9pfs: improper access control on special files
A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. The 9pfs server did not prohibit opening special files on the host side, potentially allowing a malicious client to escape from the exported 9p tree by creating and opening a dev…
-
Medium 6.4
Qemu: improper ide controller reset can lead to mbr overwrite
A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be targeted to offset 0 instead (potentially overwriting the VM's boot code). This could be used, for example, by L2 guests with a virtual disk (vdiskL2) stored…
-
Medium 6.5
Qemu: vnc: infinite loop in inflate_buffer() leads to denial of service
A flaw was found in the QEMU built-in VNC server while processing ClientCutText messages. A wrong exit condition may lead to an infinite loop when inflating an attacker controlled zlib buffer in the `inflate_buffer` function. This could allow a remote authent…
-
Medium 5.6
Triggerable assertion due to race condition in hot-unplug
A flaw was found in QEMU. The async nature of hot-unplug enables a race scenario where the net device backend is cleared before the virtio-net pci frontend has been unplugged. A malicious guest could use this time window to trigger an assertion and cause a de…
-
Unscored —
QEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset in hw/scsi/scsi-disk.c because scsi_disk_emulate…
-
Unscored —
The hardware emulation in the of_dpa_cmd_add_l2_flood of rocker device model in QEMU, as used in 7.0.0 and earlier, all…
-
Medium 6.0
Heap buffer overflow in virtio_crypto_sym_op_helper()
A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in virtio_crypto_handle_sym_req. There is no check for the value of `src_len` and `dst_len` in virtio_crypto_sym_op_helper, potentially leading to a heap buf…
-
Low 3.3
Qemu: 9pfs: suid/sgid bits not dropped on file write
A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. When a local user in the guest writes an executable file with SUID or SGID, none of these privileged bits are correctly dropped. As a result, in rare circumstances, this flaw cou…
-
Medium 6.0
Qemu: e1000e: heap use-after-free in e1000e_write_packet_to_guest()
A DMA reentrancy issue leading to a use-after-free error was found in the e1000e NIC emulation code in QEMU. This issue could allow a privileged guest user to crash the QEMU process on the host, resulting in a denial of service.
-
High 7.5
Improper i/o watch removal in tls handshake can lead to remote unauthenticated denial of service
A flaw was found in the QEMU built-in VNC server. When a client connects to the VNC server, QEMU checks whether the current number of connections crosses a certain threshold and if so, cleans up the previous connection. If the previous connection happens to b…
-
Medium 6.0
Qemu: pvrdma: out-of-bounds read in pvrdma_ring_next_elem_read()
A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to allocate and initialize a huge number of page tables to be used as a ring of descriptors for CQ and async events, potentially leading t…
-
Medium 5.3
Qemu: lsi53c895a: dma reentrancy issue leads to stack overflow
A vulnerability in the lsi53c895a device affects the latest version of qemu. A DMA-MMIO reentrancy problem may lead to memory corruption bugs like stack overflow or use-after-free.
-
Medium 6.5
An out-of-bounds read flaw was found in the QXL display device emulation in QEMU. The qxl_phys2virt() function does not…
-
High 8.6
An off-by-one read/write issue was found in the SDHCI device of QEMU. It occurs when reading/writing the Buffer Data Po…
-
Medium 6.5
An integer underflow issue was found in the QEMU VNC server while processing ClientCutText messages in the extended for…
-
High 7.8
A DMA reentrancy issue was found in the Tulip device emulation in QEMU. When Tulip reads or writes to the rx/tx descrip…
-
Unscored —
A flaw was found in the QEMU virtio-fs shared file system daemon (virtiofsd) implementation. This flaw is strictly rela…
-
Unscored —CVE-2021-3929 Public exploit
A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is similar to CVE-202…
-
Unscored —
A NULL pointer dereference issue was found in the ACPI code of QEMU. A malicious, privileged user within the guest coul…
-
Unscored —
softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the translate_fail path, leading to an io_…
-
Unscored —
A stack overflow vulnerability was found in the Intel HD Audio device (intel-hda) of QEMU. A malicious guest could use …
-
Unscored —
A DMA reentrancy issue was found in the USB EHCI controller emulation of QEMU. EHCI does not verify if the Buffer Point…
-
Unscored —
A flaw was found in the QXL display device emulation in QEMU. An integer overflow in the cursor_alloc() function can le…
-
Unscored —
A flaw was found in the QXL display device emulation in QEMU. A double fetch of guest controlled values `cursor->header…
-
Unscored —
A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest drive…
-
Unscored —
A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the descriptor's address…
-
Unscored —
An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx…
-
Unscored —
A flaw was found in the vhost-vsock device of QEMU. In case of error, an invalid element was not detached from the virt…
-
Unscored —
A flaw was found in the virtio-net device of QEMU. This flaw was inadvertently introduced with the fix for CVE-2021-374…
-
Unscored —
An out-of-bounds memory access flaw was found in the ATI VGA device emulation of QEMU. This flaw occurs in the ati_2d_b…
-
Unscored —
A stack-buffer-overflow was found in QEMU in the NVME component. The flaw lies in nvme_changed_nslist() where a malicio…
-
Unscored —
An off-by-one error was found in the SCSI device emulation in QEMU. It could occur while processing MODE SELECT command…
-
Unscored —
A NULL pointer dereference issue was found in the block mirror layer of QEMU in versions prior to 6.2.0. The `self` poi…
-
Unscored —
An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.…
-
Unscored —
A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs when dropping…
-
Unscored —
A stack overflow via an infinite recursion vulnerability was found in the eepro100 i8255x device emulator of QEMU. This…