CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 0CVE-2024-7730 – Qemu-kvm: virtio-snd: heap buffer overflow in virtio_snd_pcm_in_cb()
https://notcve.org/view.php?id=CVE-2024-7730
14 Nov 2024 — A heap buffer overflow was found in the virtio-snd device in QEMU. When reading input audio in the virtio-snd input callback, virtio_snd_pcm_in_cb, the function did not check whether the iov can fit the data buffer. This issue can trigger an out-of-bounds write if the size of the virtio queue element is equal to virtio_snd_pcm_status, which makes the available space for audio data zero. • https://access.redhat.com/security/cve/CVE-2024-7730 • CWE-122: Heap-based Buffer Overflow •
CVSS: 6.0EPSS: 0%CPEs: 21EXPL: 0CVE-2024-3447 – Qemu: sdhci: heap buffer overflow in sdhci_write_dataport()
https://notcve.org/view.php?id=CVE-2024-3447
14 Nov 2024 — A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s->data_count` and the size of `s->fifo_buffer` are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition. • https://access.redhat.com/security/cve/CVE-2024-3447 • CWE-122: Heap-based Buffer Overflow •
CVSS: 8.2EPSS: 0%CPEs: 3EXPL: 0CVE-2024-6519 – Qemu: scsi: lsi53c895a: use-after-free local privilege escalation vulnerability
https://notcve.org/view.php?id=CVE-2024-6519
15 Oct 2024 — A use-after-free vulnerability was found in the QEMU LSI53C895A SCSI Host Bus Adapter emulation. This issue can lead to a crash or VM escape. This vulnerability allows local attackers to escalate privileges on affected installations of QEMU. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the implementation of the virtual LSI53C895A SCSI Host Bus Adapter. The issue results from the la... • https://access.redhat.com/security/cve/CVE-2024-6519 • CWE-416: Use After Free •
CVSS: 3.8EPSS: 0%CPEs: 2EXPL: 0CVE-2024-8612 – Qemu-kvm: information leak in virtio devices
https://notcve.org/view.php?id=CVE-2024-8612
20 Sep 2024 — A flaw was found in QEMU, in the virtio-scsi, virtio-blk, and virtio-crypto devices. The size for virtqueue_push as set in virtio_scsi_complete_req / virtio_blk_req_complete / virito_crypto_req_complete could be larger than the true size of the data which has been sent to guest. Once virtqueue_push() finally calls dma_memory_unmap to ummap the in_iov, it may call the address_space_write function to write back the data. Some uninitialized data may exist in the bounce.buffer, leading to an information leak. • https://access.redhat.com/security/cve/CVE-2024-8612 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2024-8354 – Qemu-kvm: usb: assertion failure in usb_ep_get()
https://notcve.org/view.php?id=CVE-2024-8354
19 Sep 2024 — A flaw was found in QEMU. An assertion failure was present in the usb_ep_get() function in hw/net/core.c when trying to get the USB endpoint from a USB device. This flaw may allow a malicious unprivileged guest user to crash the QEMU process on the host and cause a denial of service condition. Se encontró una falla en QEMU. Se produjo un error de aserción en la función usb_ep_get() en hw/net/core.c al intentar obtener el endpoint USB de un dispositivo USB. • https://access.redhat.com/security/cve/CVE-2024-8354 • CWE-617: Reachable Assertion •
CVSS: 6.2EPSS: 0%CPEs: 4EXPL: 0CVE-2024-8235 – Libvirt: crash of virtinterfaced via virconnectlistinterfaces()
https://notcve.org/view.php?id=CVE-2024-8235
30 Aug 2024 — A flaw was found in libvirt. A refactor of the code fetching the list of interfaces for multiple APIs introduced a corner case on platforms where allocating 0 bytes of memory results in a NULL pointer. This corner case would lead to a NULL-pointer dereference and subsequent crash of virtinterfaced. This issue could allow clients connecting to the read-only socket to crash the virtinterfaced daemon. • https://access.redhat.com/security/cve/CVE-2024-8235 • CWE-476: NULL Pointer Dereference •
CVSS: 7.8EPSS: 0%CPEs: 25EXPL: 0CVE-2024-7409 – Qemu: denial of service via improper synchronization in qemu nbd server during socket closure
https://notcve.org/view.php?id=CVE-2024-7409
05 Aug 2024 — A flaw was found in the QEMU NBD Server. This vulnerability allows a denial of service (DoS) attack via improper synchronization during socket closure when a client keeps a socket open as the server is taken offline. Red Hat OpenShift Container Platform release 4.16.25 is now available with updates to packages and images that fix several bugs and add enhancements. Issues addressed include bypass and denial of service vulnerabilities. • https://access.redhat.com/security/cve/CVE-2024-7409 • CWE-662: Improper Synchronization •
CVSS: 7.4EPSS: 0%CPEs: 11EXPL: 0CVE-2024-7383 – Libnbd: nbd server improper certificate validation
https://notcve.org/view.php?id=CVE-2024-7383
05 Aug 2024 — A flaw was found in libnbd. The client did not always correctly verify the NBD server's certificate when using TLS to connect to an NBD server. This issue allows a man-in-the-middle attack on NBD traffic. • https://access.redhat.com/security/cve/CVE-2024-7383 • CWE-295: Improper Certificate Validation •
CVSS: 7.8EPSS: 0%CPEs: 31EXPL: 0CVE-2024-4467 – Qemu-kvm: 'qemu-img info' leads to host file read/write
https://notcve.org/view.php?id=CVE-2024-4467
02 Jul 2024 — A flaw was found in the QEMU disk image utility (qemu-img) 'info' command. A specially crafted image file containing a `json:{}` value describing block devices in QMP could cause the qemu-img process on the host to consume large amounts of memory or CPU time, leading to denial of service or read/write to an existing external file. Se encontró una falla en el comando 'info' de la utilidad de imagen de disco QEMU (qemu-img). Un archivo de imagen especialmente manipulado que contenga un valor `json:{}` que des... • http://www.openwall.com/lists/oss-security/2024/07/23/2 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 5.5EPSS: 0%CPEs: 2EXPL: 0CVE-2024-4693 – Qemu-kvm: virtio-pci: improper release of configure vector leads to guest triggerable crash
https://notcve.org/view.php?id=CVE-2024-4693
10 May 2024 — A flaw was found in the QEMU Virtio PCI Bindings (hw/virtio/virtio-pci.c). An improper release and use of the irqfd for vector 0 during the boot process leads to a guest triggerable crash via vhost_net_stop(). This flaw allows a malicious guest to crash the QEMU process on the host. Se encontró una falla en los enlaces QEMU Virtio PCI (hw/virtio/virtio-pci.c). Una liberación y un uso inadecuados del irqfd para el vector 0 durante el proceso de arranque provocan un fallo desencadenable por el invitado a trav... • https://access.redhat.com/security/cve/CVE-2024-4693 • CWE-672: Operation on a Resource after Expiration or Release •