442 results · Feed
-
Medium 6.0
Out-of-bounds read information disclosure vulnerability
A heap out-of-bounds memory read flaw was found in the virtual nvme device in QEMU. The QEMU process does not validate an offset provided by the guest before computing a host heap pointer, which is used for copying data back to the guest. Arbitrary heap memor…
-
Medium 6.0
Heap buffer overflow in virtio_crypto_sym_op_helper()
A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in virtio_crypto_handle_sym_req. There is no check for the value of `src_len` and `dst_len` in virtio_crypto_sym_op_helper, potentially leading to a heap buf…
-
Low 3.3
Qemu: 9pfs: suid/sgid bits not dropped on file write
A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. When a local user in the guest writes an executable file with SUID or SGID, none of these privileged bits are correctly dropped. As a result, in rare circumstances, this flaw cou…
-
Medium 6.0
Qemu: e1000e: heap use-after-free in e1000e_write_packet_to_guest()
A DMA reentrancy issue leading to a use-after-free error was found in the e1000e NIC emulation code in QEMU. This issue could allow a privileged guest user to crash the QEMU process on the host, resulting in a denial of service.
-
High 7.5
Improper i/o watch removal in tls handshake can lead to remote unauthenticated denial of service
A flaw was found in the QEMU built-in VNC server. When a client connects to the VNC server, QEMU checks whether the current number of connections crosses a certain threshold and if so, cleans up the previous connection. If the previous connection happens to b…
-
Medium 6.0
Qemu: pvrdma: out-of-bounds read in pvrdma_ring_next_elem_read()
A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to allocate and initialize a huge number of page tables to be used as a ring of descriptors for CQ and async events, potentially leading t…
-
Medium 5.3
Qemu: lsi53c895a: dma reentrancy issue leads to stack overflow
A vulnerability in the lsi53c895a device affects the latest version of qemu. A DMA-MMIO reentrancy problem may lead to memory corruption bugs like stack overflow or use-after-free.
-
Medium 6.5
An out-of-bounds read flaw was found in the QXL display device emulation in QEMU. The qxl_phys2virt() function does not…
-
Medium 6.5
An integer overflow and buffer overflow issues were found in the ACPI Error Record Serialization Table (ERST) device of…
-
High 8.6
An off-by-one read/write issue was found in the SDHCI device of QEMU. It occurs when reading/writing the Buffer Data Po…
-
Medium 6.5
An integer underflow issue was found in the QEMU VNC server while processing ClientCutText messages in the extended for…
-
High 7.8
A DMA reentrancy issue was found in the Tulip device emulation in QEMU. When Tulip reads or writes to the rx/tx descrip…
-
Unscored —
A flaw was found in the QEMU virtio-fs shared file system daemon (virtiofsd) implementation. This flaw is strictly rela…
-
Unscored —
A deadlock issue was found in the AHCI controller device of QEMU. It occurs on a software reset (ahci_reset_port) while…
-
Unscored —
A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of QEMU. The flaw occurs whi…
-
Unscored —CVE-2021-3929 Public exploit
A DMA reentrancy issue was found in the NVM Express Controller (NVME) emulation in QEMU. This CVE is similar to CVE-202…
-
Unscored —
A NULL pointer dereference issue was found in the ACPI code of QEMU. A malicious, privileged user within the guest coul…
-
Unscored —
An infinite loop flaw was found in the USB xHCI controller emulation of QEMU while computing the length of the Transfer…
-
Unscored —
softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the translate_fail path, leading to an io_…
-
Unscored —
A stack overflow vulnerability was found in the Intel HD Audio device (intel-hda) of QEMU. A malicious guest could use …
-
Unscored —
A DMA reentrancy issue was found in the USB EHCI controller emulation of QEMU. EHCI does not verify if the Buffer Point…
-
Unscored —
A flaw was found in the QXL display device emulation in QEMU. An integer overflow in the cursor_alloc() function can le…
-
Unscored —
A flaw was found in the QXL display device emulation in QEMU. A double fetch of guest controlled values `cursor->header…
-
Unscored —
A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest drive…
-
Unscored —
A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. The issue occurs while handling a "PVR…
-
Unscored —
A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the descriptor's address…
-
Unscored —
An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx…
-
Unscored —
A flaw was found in the vhost-vsock device of QEMU. In case of error, an invalid element was not detached from the virt…
-
Unscored —
A flaw was found in the virtio-net device of QEMU. This flaw was inadvertently introduced with the fix for CVE-2021-374…
-
Unscored —
An out-of-bounds memory access flaw was found in the ATI VGA device emulation of QEMU. This flaw occurs in the ati_2d_b…
-
Unscored —
A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions prior to 6.1.0. The issue o…
-
Unscored —
An integer overflow was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions prior to 6.1.0…
-
Unscored —
A stack-buffer-overflow was found in QEMU in the NVME component. The flaw lies in nvme_changed_nslist() where a malicio…
-
Unscored —
An off-by-one error was found in the SCSI device emulation in QEMU. It could occur while processing MODE SELECT command…
-
Unscored —
A NULL pointer dereference issue was found in the block mirror layer of QEMU in versions prior to 6.2.0. The `self` poi…
-
Unscored —
An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.…
-
Unscored —
A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs when dropping…
-
Unscored —
An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in th…
-
Unscored —
An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in th…
-
Unscored —
An invalid pointer initialization issue was found in the SLiRP networking implementation of QEMU. The flaw exists in th…