Skip to content
OpenAdvisories
Medium · 6.5 CVE-2022-4144 EUVD-2022-51506GHSA-rc5v-q774-439g

An out-of-bounds read flaw was found in the QXL display device emulation in QEMU. The qxl_phys2virt() function does not check the size of t…

Published Nov 29, 2022 · Updated Apr 14, 2025 · Assigned by redhat

Description

An out-of-bounds read flaw was found in the QXL display device emulation in QEMU. The qxl_phys2virt() function does not check the size of the structure pointed to by the guest physical address, potentially reading past the end of the bar space into adjacent pages. A malicious guest user could use this flaw to crash the QEMU process on the host causing a denial of service condition.

Affected products

VendorProductAffectedFixed
— QEMU (QXL device) affects versions up to latest v7.1.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 qemu 1:7.2+dfsg-1 —
Debian 13 qemu 1:7.2+dfsg-1 —
Debian 12 qemu 1:7.2+dfsg-1 —
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS qemu 1:6.2+dfsg-2ubuntu6.11 USN-6167-1
Ubuntu 20.04 LTS qemu 1:4.2-3ubuntu6.27 USN-6167-1
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 18.04 LTS qemu 1:2.11+dfsg-1ubuntu7.42+esm1 USN-6167-1
Ubuntu Pro 16.04 LTS qemu 1:2.5+dfsg-5ubuntu10.51+esm2 USN-6167-1
Ubuntu Pro 14.04 LTS qemu 2.0.0+dfsg-2ubuntu1.47+esm3 USN-6167-1
ReleasePackageFixed inAdvisory
RHEL 8 SLOF 20210217-1.module+el8.7.0+16689+53d59bc2 RHSA-2023:0099
RHEL 8 hivex +6 1.3.18-23.module+el8.7.0+16689+53d59bc2 RHSA-2023:0099
RHEL 8 libguestfs-winsupport 8.6-1.module+el8.7.0+16689+53d59bc2 RHSA-2023:0099
RHEL 8 libiscsi +2 1.18.0-8.module+el8.7.0+16689+53d59bc2 RHSA-2023:0099
RHEL 8 libnbd +6 1.6.0-5.module+el8.7.0+16689+53d59bc2 RHSA-2023:0099
RHEL 8 libtpms +1 0.9.1-1.20211126git1ff6fe1f43.module+el8.7.0+16689+53d59bc2 RHSA-2023:0099
RHEL 8 libvirt +27 8.0.0-10.1.module+el8.7.0+17192+cbc2449b RHSA-2023:0099
RHEL 8 libvirt-dbus 1.3.0-2.module+el8.7.0+16689+53d59bc2 RHSA-2023:0099
RHEL 8 libvirt-python +1 8.0.0-2.module+el8.7.0+16689+53d59bc2 RHSA-2023:0099
RHEL 8 nbdkit +18 1.24.0-4.module+el8.7.0+16689+53d59bc2 RHSA-2023:0099
RHEL 8 netcf +2 0.2.8-12.module+el8.7.0+16689+53d59bc2 RHSA-2023:0099
RHEL 8 perl-Sys-Virt 8.0.0-1.module+el8.7.0+16689+53d59bc2 RHSA-2023:0099
RHEL 8 qemu-img +14 15:6.2.0-21.module+el8.7.0+17573+effbd7e8.2 RHSA-2023:0099
RHEL 8 seabios +2 1.16.0-3.module+el8.7.0+16689+53d59bc2 RHSA-2023:0099
RHEL 8 sgabios +1 1:0.20170427git-3.module+el8.7.0+16689+53d59bc2 RHSA-2023:0099
RHEL 8 supermin +1 5.2.1-2.module+el8.7.0+16689+53d59bc2 RHSA-2023:0099
RHEL 8 swtpm +4 0.7.0-4.20211109gitb79fd91.module+el8.7.0+16689+53d59bc2 RHSA-2023:0099
RHEL 8 virt-dib +24 1:1.44.0-9.module+el8.7.0+16689+53d59bc2 RHSA-2023:0099
RHEL 8 virt-v2v +3 1:1.42.0-21.module+el8.7.0+16689+53d59bc2 RHSA-2023:0099
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
RHEL 8.6 EUS SLOF 20210217-1.module+el8.6.0+14480+c0a3aa0f RHSA-2023:0432
RHEL 8.6 EUS hivex +6 1.3.18-23.module+el8.6.0+14480+c0a3aa0f RHSA-2023:0432
RHEL 8.6 EUS libguestfs-winsupport 8.6-1.module+el8.6.0+14480+c0a3aa0f RHSA-2023:0432
RHEL 8.6 EUS libiscsi +2 1.18.0-8.module+el8.6.0+14480+c0a3aa0f RHSA-2023:0432
RHEL 8.6 EUS libnbd +6 1.6.0-5.module+el8.6.0+14480+c0a3aa0f RHSA-2023:0432
RHEL 8.6 EUS libtpms +1 0.9.1-0.20211126git1ff6fe1f43.module+el8.6.0+14480+c0a3aa0f RHSA-2023:0432
RHEL 8.6 EUS libvirt +27 8.0.0-5.6.module+el8.6.0+17751+d6559882 RHSA-2023:0432
RHEL 8.6 EUS libvirt-dbus 1.3.0-2.module+el8.6.0+14480+c0a3aa0f RHSA-2023:0432
RHEL 8.6 EUS libvirt-python +1 8.0.0-1.1.module+el8.6.0+16381+3abc475c RHSA-2023:0432
RHEL 8.6 EUS nbdkit +18 1.24.0-4.module+el8.6.0+14480+c0a3aa0f RHSA-2023:0432
RHEL 8.6 EUS netcf +2 0.2.8-12.module+el8.6.0+14480+c0a3aa0f RHSA-2023:0432
RHEL 8.6 EUS perl-Sys-Virt 8.0.0-1.module+el8.6.0+14480+c0a3aa0f RHSA-2023:0432
RHEL 8.6 EUS qemu-img +14 15:6.2.0-11.module+el8.6.0+17576+33ee06a8.7 RHSA-2023:0432
RHEL 8.6 EUS seabios +2 1.15.0-2.module+el8.6.0+14757+c25ee005 RHSA-2023:0432
RHEL 8.6 EUS sgabios +1 1:0.20170427git-3.module+el8.6.0+14480+c0a3aa0f RHSA-2023:0432
RHEL 8.6 EUS supermin +1 5.2.1-1.module+el8.6.0+14480+c0a3aa0f RHSA-2023:0432
RHEL 8.6 EUS swtpm +4 0.7.0-3.20211109gitb79fd91.module+el8.6.0+16156+d5629340 RHSA-2023:0432
RHEL 8.6 EUS virt-dib +24 1:1.44.0-5.module+el8.6.0+14480+c0a3aa0f RHSA-2023:0432
RHEL 8.6 EUS virt-v2v +3 1:1.42.0-19.module+el8.6.0+15577+2ffd6ffa RHSA-2023:0432

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 8 SLOF 20210217-1.module_el8.6.0+2880+7d9e3703 ALSA-2023:0099
AlmaLinux 8 hivex +6 1.3.18-23.module_el8.6.0+2880+7d9e3703 ALSA-2023:0099
AlmaLinux 8 libguestfs-winsupport 8.6-1.module_el8.6.0+2880+7d9e3703 ALSA-2023:0099
AlmaLinux 8 libiscsi +2 1.18.0-8.module_el8.6.0+2880+7d9e3703 ALSA-2023:0099
AlmaLinux 8 libnbd +6 1.6.0-5.module_el8.6.0+2880+7d9e3703 ALSA-2023:0099
AlmaLinux 8 libtpms +1 0.9.1-1.20211126git1ff6fe1f43.module_el8.7.0+3346+68867adb ALSA-2023:0099
AlmaLinux 8 libvirt +27 8.0.0-10.1.module_el8.7.0+3387+571b583b ALSA-2023:0099
AlmaLinux 8 libvirt-dbus 1.3.0-2.module_el8.6.0+2880+7d9e3703 ALSA-2023:0099
AlmaLinux 8 nbdkit +18 1.24.0-4.module_el8.6.0+2880+7d9e3703 ALSA-2023:0099
AlmaLinux 8 netcf +2 0.2.8-12.module_el8.6.0+2880+7d9e3703 ALSA-2023:0099
AlmaLinux 8 perl-Sys-Virt 8.0.0-1.module_el8.6.0+2880+7d9e3703 ALSA-2023:0099
AlmaLinux 8 python3-libvirt 8.0.0-2.module_el8.7.0+3346+68867adb ALSA-2023:0099
AlmaLinux 8 qemu-img +14 15:6.2.0-21.module_el8.7.0+3387+571b583b.2 ALSA-2023:0099
AlmaLinux 8 seabios +2 1.16.0-3.module_el8.7.0+3346+68867adb ALSA-2023:0099
AlmaLinux 8 sgabios +1 1:0.20170427git-3.module_el8.6.0+2880+7d9e3703 ALSA-2023:0099
AlmaLinux 8 supermin +1 5.2.1-2.module_el8.7.0+3346+68867adb ALSA-2023:0099
AlmaLinux 8 swtpm +4 0.7.0-4.20211109gitb79fd91.module_el8.7.0+3346+68867adb ALSA-2023:0099
AlmaLinux 8 virt-dib +24 1:1.44.0-9.module_el8.7.0+3346+68867adb.alma ALSA-2023:0099
AlmaLinux 8 virt-v2v +3 1:1.42.0-21.module_el8.7.0+3346+68867adb ALSA-2023:0099

Rocky Linux

Errata ↗
ReleasePackageFixed inAdvisory
Rocky Linux 8 hivex 1.3.18-23.module+el8.6.0+847+b490afdd RLSA-2023:0099
Rocky Linux 8 libguestfs 1:1.44.0-9.module+el8.7.0+1084+97b81f61.rocky RLSA-2023:0099
Rocky Linux 8 libguestfs-winsupport 8.6-1.module+el8.6.0+847+b490afdd RLSA-2023:0099
Rocky Linux 8 libiscsi 1.18.0-8.module+el8.4.0+534+4680a14e RLSA-2023:0099
Rocky Linux 8 libnbd 1.6.0-5.module+el8.6.0+847+b490afdd RLSA-2023:0099
Rocky Linux 8 libtpms 0.9.1-1.20211126git1ff6fe1f43.module+el8.7.0+1084+97b81f61 RLSA-2023:0099
Rocky Linux 8 libvirt 8.0.0-10.1.module+el8.7.0+1125+fc135c6d RLSA-2023:0099
Rocky Linux 8 libvirt-dbus 1.3.0-2.module+el8.4.0+534+4680a14e RLSA-2023:0099
Rocky Linux 8 libvirt-python 8.0.0-2.module+el8.7.0+1084+97b81f61 RLSA-2023:0099
Rocky Linux 8 nbdkit 1.24.0-4.module+el8.6.0+847+b490afdd RLSA-2023:0099
Rocky Linux 8 netcf 0.2.8-12.module+el8.4.0+534+4680a14e RLSA-2023:0099
Rocky Linux 8 perl-Sys-Virt 8.0.0-1.module+el8.6.0+847+b490afdd RLSA-2023:0099
Rocky Linux 8 qemu-kvm 5:6.2.0-21.module+el8.7.0+1125+fc135c6d.2 RLSA-2023:0099
Rocky Linux 8 seabios 1.16.0-3.module+el8.7.0+1084+97b81f61 RLSA-2023:0099
Rocky Linux 8 sgabios 1:0.20170427git-3.module+el8.4.0+534+4680a14e RLSA-2023:0099
Rocky Linux 8 supermin 5.2.1-2.module+el8.7.0+1084+97b81f61 RLSA-2023:0099
Rocky Linux 8 swtpm 0.7.0-4.20211109gitb79fd91.module+el8.7.0+1084+97b81f61 RLSA-2023:0099
Rocky Linux 8 virt-v2v 1:1.42.0-21.module+el8.7.0+1084+97b81f61 RLSA-2023:0099
ReleasePackageFixed inAdvisory
SLES 15 SP4 qemu 6.2.0-150400.37.11.1 SUSE-SU-2023:0671-1
SLES 15 SP3 qemu 5.2.0-150300.121.2 SUSE-SU-2023:0840-1
SLES 15 SP2 qemu 4.2.1-150200.72.2 SUSE-SU-2023:0878-1
SLES 15 SP1 qemu 3.1.1.1-150100.80.46.1 SUSE-SU-2023:0877-1
SLES 12 SP5 qemu 3.1.1.1-66.1 SUSE-SU-2023:0761-1
Show 15 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP3 qemu 5.2.0-150300.121.2 SUSE-SU-2023:0840-1
SLES for SAP 15 SP2 qemu 4.2.1-150200.72.2 SUSE-SU-2023:0878-1
SLES for SAP 15 SP1 qemu 3.1.1.1-150100.80.46.1 SUSE-SU-2023:0877-1
SLES for SAP 12 SP5 qemu 3.1.1.1-66.1 SUSE-SU-2023:0761-1
SLE Real Time 15 SP3 qemu 5.2.0-150300.121.2 SUSE-SU-2023:0840-1
SLE Micro 5.3 qemu 6.2.0-150400.37.11.1 SUSE-SU-2023:0671-1
SLE Micro 5.2 qemu 5.2.0-150300.121.2 SUSE-SU-2023:0840-1
SLE Micro 5.1 qemu 5.2.0-150300.121.2 SUSE-SU-2023:0840-1
SLE HPC 15 SP3 qemu 5.2.0-150300.121.2 SUSE-SU-2023:0840-1
SLE HPC 15 SP2 qemu 4.2.1-150200.72.2 SUSE-SU-2023:0878-1
SLE HPC 15 SP1 qemu 3.1.1.1-150100.80.46.1 SUSE-SU-2023:0877-1
SUSE Manager Server 4.2 qemu 5.2.0-150300.121.2 SUSE-SU-2023:0840-1
SUSE Manager Proxy 4.2 qemu 5.2.0-150300.121.2 SUSE-SU-2023:0840-1
SUSE Enterprise Storage 7.1 qemu 5.2.0-150300.121.2 SUSE-SU-2023:0840-1
SUSE Enterprise Storage 7 qemu 4.2.1-150200.72.2 SUSE-SU-2023:0878-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed qemu 7.1.0-10.1 openSUSE-SU-2024:12685-1
openSUSE Leap 15.4 qemu 4.2.1-150200.72.2 SUSE-SU-2023:0878-1, SUSE-SU-2023:0671-1
openSUSE Leap 15.4 qemu-linux-user 6.2.0-150400.37.11.1 SUSE-SU-2023:0671-1
openSUSE Leap 15.4 qemu-testsuite 6.2.0-150400.37.11.2 SUSE-SU-2023:0671-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
openSUSE Leap Micro 5.3 qemu 6.2.0-150400.37.11.1 SUSE-SU-2023:0671-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2 qemu +26 10:3.1.0-8.amzn2.0.10 ALAS2-2023-2061

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 qemu 6.2.0-18 —
Azure Linux 2 (CBL-Mariner) qemu 6.2.0-12 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 8 hivex +4 1.3.18-21.module+el8.7.0+21037+8ee66348 ELSA-2023-12342, ELSA-2023-12195, ELSA-2023-0099
Oracle Linux 8 libguestfs-appliance 1:1.44.0-5.0.1.module+el8.7.0+20916+50473d5a ELSA-2023-12195, ELSA-2023-0099
Oracle Linux 8 libguestfs-winsupport 8.2-1.module+el8.7.0+21037+8ee66348 ELSA-2023-12342, ELSA-2023-12195, ELSA-2023-0099
Oracle Linux 8 libiscsi +2 1.18.0-8.module+el8.7.0+20875+5dd40464 ELSA-2023-12342, ELSA-2023-12195, ELSA-2023-0099
Oracle Linux 8 libnbd +3 1.2.2-1.module+el8.7.0+21037+8ee66348 ELSA-2023-12342, ELSA-2023-12195, ELSA-2023-0099
Oracle Linux 8 libtpms +1 0.9.1-0.20211126git1ff6fe1f43.module+el8.7.0+20916+50473d5a ELSA-2023-12195, ELSA-2023-0099
Oracle Linux 8 libvirt +29 5.7.0-40.module+el8.7.0+21037+8ee66348 ELSA-2023-12342, ELSA-2023-12195, ELSA-2023-0099
Oracle Linux 8 libvirt-dbus 1.3.0-2.module+el8.7.0+20875+5dd40464 ELSA-2023-12342, ELSA-2023-12195, ELSA-2023-0099
Oracle Linux 8 libvirt-wireshark 7.10.0-2.module+el8.7.0+20916+50473d5a ELSA-2023-12195, ELSA-2023-0099
Oracle Linux 8 nbdkit +13 1.16.2-4.0.1.module+el8.7.0+21037+8ee66348 ELSA-2023-12342, ELSA-2023-12195, ELSA-2023-0099
Oracle Linux 8 nbdkit-nbd-plugin +4 1.24.0-4.module+el8.7.0+20875+5dd40464 ELSA-2023-12195, ELSA-2023-0099
Oracle Linux 8 netcf +2 0.2.8-12.module+el8.7.0+20875+5dd40464 ELSA-2023-12342, ELSA-2023-12195, ELSA-2023-0099
Oracle Linux 8 ocaml-hivex +1 1.3.18-23.module+el8.7.0+20875+5dd40464 ELSA-2023-0099
Oracle Linux 8 ocaml-libguestfs +1 1:1.44.0-9.0.1.module+el8.7.0+20875+5dd40464 ELSA-2023-0099
Oracle Linux 8 ocaml-libnbd +2 1.6.0-5.module+el8.7.0+20875+5dd40464 ELSA-2023-12195, ELSA-2023-0099
Oracle Linux 8 perl-Sys-Virt 4.5.0-5.module+el8.7.0+21037+8ee66348 ELSA-2023-12342, ELSA-2023-12195, ELSA-2023-0099
Oracle Linux 8 qemu-img +9 15:4.2.1-26.module+el8.7.0+21037+8ee66348 ELSA-2023-12342, ELSA-2023-12195, ELSA-2023-0099
Oracle Linux 8 qemu-kvm-docs +4 15:6.2.0-21.module+el8.7.0+20905+f38afd22.2 ELSA-2023-0099
Oracle Linux 8 qemu-virtiofsd 15:6.1.1-5.module+el8.7.0+20916+50473d5a ELSA-2023-12195
Oracle Linux 8 seabios +2 1.15.0-2.module+el8.7.0+20916+50473d5a ELSA-2023-12342, ELSA-2023-12195, ELSA-2023-0099
Oracle Linux 8 sgabios +1 1:0.20170427git-3.module+el8.7.0+20875+5dd40464 ELSA-2023-12342, ELSA-2023-12195, ELSA-2023-0099
Oracle Linux 8 supermin +1 5.1.19-10.module+el8.7.0+21037+8ee66348 ELSA-2023-12342, ELSA-2023-12195, ELSA-2023-0099
Oracle Linux 8 swtpm +4 0.7.0-3.20211109gitb79fd91.module+el8.7.0+20916+50473d5a ELSA-2023-12195, ELSA-2023-0099
Oracle Linux 8 virt-dib +23 1:1.40.2-28.0.4.module+el8.7.0+21037+8ee66348 ELSA-2023-12342, ELSA-2023-12195, ELSA-2023-0099
Oracle Linux 8 virt-v2v-man-pages-ja +2 1:1.42.0-19.0.1.module+el8.7.0+20916+50473d5a ELSA-2023-12195, ELSA-2023-0099
Oracle Linux 7 qemu +12 15:4.2.1-26.el7 ELSA-2023-12368

Advisories 18

References