Description
In QEMU 4.1.0, an out-of-bounds read flaw was found in the ATI VGA implementation. It occurs in the ati_cursor_define() routine while handling MMIO write operations through the ati_mm_write() callback. A malicious guest could abuse this flaw to crash the QEMU process, resulting in a denial of service.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | qemu | 1:4.2-1 | — |
| Debian 13 | qemu | 1:4.2-1 | — |
| Debian 12 | qemu | 1:4.2-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | qemu +12 | 15:4.2.1-5.el7 | ELSA-2021-9109, ELSA-2021-9104 |
Advisories 3
- WID-SEC-2024-1972 QEMU: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Sep 2, 2024
- ELSA-2021-9109 Important: qemu security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Mar 15, 2021
- ELSA-2021-9104 Important: qemu security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Mar 12, 2021