Description
hw/sparc64/sun4u.c in QEMU 3.1.50 is vulnerable to a NULL pointer dereference, which allows the attacker to cause a denial of service via a device driver.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | qemu | 1:3.1+dfsg-8 | — |
| Debian 13 | qemu | 1:3.1+dfsg-8 | — |
| Debian 12 | qemu | 1:3.1+dfsg-8 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 18.04 LTS | qemu | 1:2.11+dfsg-1ubuntu7.13 | USN-3978-1 |
| Ubuntu 16.04 LTS | qemu | 1:2.5+dfsg-5ubuntu10.38 | USN-3978-1 |
| Ubuntu 14.04 LTS | qemu | 2.0.0+dfsg-2ubuntu1.46 | USN-3978-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP1 | qemu | 3.1.1-9.3.3 | SUSE-SU-2019:2192-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.1 | qemu +1 | 3.1.1-lp151.7.3.3 | openSUSE-SU-2019:2041-1 |
| openSUSE Leap 15.1 | qemu-linux-user | 3.1.1-lp151.7.3.2 | openSUSE-SU-2019:2041-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | qemu +26 | 10:3.1.0-7.amzn2.0.1 | ALAS2-2019-1248 |
Advisories 5
- USN-3978-1 qemu update Ubuntu Security Notices (USN) · Jun 1, 2026
- openSUSE-SU-2019:2041-1 Security update for qemu SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:2192-1 Security update for qemu SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-1987 QEMU: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Sep 2, 2024
- ALAS2-2019-1248 Important: qemu security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jul 22, 2019
References
- https://git.qemu.org/?p=qemu.git%3Ba=history%3Bf=hw/sparc64/sun4u.c%3Bhb=HEAD
- https://fakhrizulkifli.github.io/posts/2019/01/03/CVE-2019-5008/
- 108024 vdb-entry
- USN-3978-1 vendor-advisory
- FEDORA-2019-52a8f5468e vendor-advisory
- FEDORA-2019-e9de40d53f vendor-advisory
- openSUSE-SU-2019:2041 vendor-advisory