Description
A stack-buffer-overflow was found in QEMU in the NVME component. The flaw lies in nvme_changed_nslist() where a malicious guest controlling certain input can read out of bounds memory. A malicious user could use this flaw leading to disclosure of sensitive information.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | QEMU | qemu-kvm 6.2.0-rc2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | qemu | 1:6.2+dfsg-1 | — |
| Debian 13 | qemu | 1:6.2+dfsg-1 | — |
| Debian 12 | qemu | 1:6.2+dfsg-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | qemu | 1:6.2+dfsg-2ubuntu5 | — |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.15 | qemu | 6.1.1-r0 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | qemu | 6.2.0-2 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | hivex +4 | 1.3.18-21.module+el8.5.0+20482+a450964e | ELSA-2022-9172 |
| Oracle Linux 8 | libguestfs-winsupport | 8.2-1.module+el8.5.0+20482+a450964e | ELSA-2022-9172 |
| Oracle Linux 8 | libiscsi +2 | 1.18.0-8.module+el8.5.0+20482+a450964e | ELSA-2022-9172 |
| Oracle Linux 8 | libnbd +3 | 1.2.2-1.module+el8.5.0+20482+a450964e | ELSA-2022-9172 |
| Oracle Linux 8 | libvirt +29 | 5.7.0-32.module+el8.5.0+20482+a450964e | ELSA-2022-9172 |
| Oracle Linux 8 | libvirt-dbus | 1.3.0-2.module+el8.5.0+20482+a450964e | ELSA-2022-9172 |
| Oracle Linux 8 | nbdkit +13 | 1.16.2-4.0.1.module+el8.5.0+20482+a450964e | ELSA-2022-9172 |
| Oracle Linux 8 | netcf +2 | 0.2.8-12.module+el8.5.0+20482+a450964e | ELSA-2022-9172 |
| Oracle Linux 8 | perl-Sys-Virt | 4.5.0-5.module+el8.5.0+20482+a450964e | ELSA-2022-9172 |
| Oracle Linux 8 | qemu-img +9 | 15:4.2.1-15.module+el8.5.0+20482+a450964e | ELSA-2022-9172 |
| Oracle Linux 8 | seabios +2 | 1.13.0-2.module+el8.5.0+20482+a450964e | ELSA-2022-9172 |
| Oracle Linux 8 | sgabios +1 | 1:0.20170427git-3.module+el8.5.0+20482+a450964e | ELSA-2022-9172 |
| Oracle Linux 8 | supermin +1 | 5.1.19-10.module+el8.5.0+20482+a450964e | ELSA-2022-9172 |
| Oracle Linux 8 | virt-dib +23 | 1:1.40.2-28.0.1.module+el8.5.0+20482+a450964e | ELSA-2022-9172 |
| Oracle Linux 7 | qemu +12 | 15:4.2.1-15.el7 | ELSA-2022-9123 |
Advisories 3
- WID-SEC-2022-1128 QEMU: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Sep 2, 2024
- ELSA-2022-9172 Important: virt:kvm_utils security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Feb 25, 2022
- ELSA-2022-9123 Important: qemu security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Feb 5, 2022