CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2020-24165
https://notcve.org/view.php?id=CVE-2020-24165
An issue was discovered in TCG Accelerator in QEMU 4.2.0, allows local attackers to execute arbitrary code, escalate privileges, and cause a denial of service (DoS). Note: This is disputed as a bug and not a valid security issue by multiple third parties. • https://bugs.launchpad.net/qemu/+bug/1863025 https://lists.debian.org/debian-lts-announce/2023/10/msg00006.html https://pastebin.com/iqCbjdT8 https://security.netapp.com/advisory/ntap-20231006-0012 •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2022-36648
https://notcve.org/view.php?id=CVE-2022-36648
The hardware emulation in the of_dpa_cmd_add_l2_flood of rocker device model in QEMU, as used in 7.0.0 and earlier, allows remote attackers to crash the host qemu and potentially execute code on the host via execute a malformed program in the guest OS. Note: This has been disputed by multiple third parties as not a valid vulnerability due to the rocker device not falling within the virtualization use case. La emulación de hardware en el of_dpa_cmd_add_l2_flood del modelo de dispositivo rocker en QEMU, tal y como se utiliza en versiones 7.0.0 y anteriores, permite a atacantes remotos bloquear al host qemu y potencialmente ejecutar código en el host a través de ejecutar un programa malformado en el SO invitado. • https://lists.nongnu.org/archive/html/qemu-devel/2022-06/msg04469.html https://security.netapp.com/advisory/ntap-20231006-0004 • CWE-476: NULL Pointer Dereference •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2023-40360
https://notcve.org/view.php?id=CVE-2023-40360
QEMU through 8.0.4 accesses a NULL pointer in nvme_directive_receive in hw/nvme/ctrl.c because there is no check for whether an endurance group is configured before checking whether Flexible Data Placement is enabled. QEMU hasta 8.0.4 accede a un puntero NULL en nvme_directive_receive en hw/nvme/ctrl.c porque no se verifica si un grupo de resistencia está configurado antes de verificar si la Ubicación Flexible de Datos está habilitada. • https://gitlab.com/birkelund/qemu/-/commit/6c8f8456cb0b239812dee5211881426496da7b98 https://gitlab.com/qemu-project/qemu/-/issues/1815 https://security.netapp.com/advisory/ntap-20230915-0004 https://www.qemu.org/docs/master/system/security.html • CWE-476: NULL Pointer Dereference •
CVSS: 6.5EPSS: 0%CPEs: 5EXPL: 0CVE-2023-4135 – Out-of-bounds read information disclosure vulnerability
https://notcve.org/view.php?id=CVE-2023-4135
A heap out-of-bounds memory read flaw was found in the virtual nvme device in QEMU. The QEMU process does not validate an offset provided by the guest before computing a host heap pointer, which is used for copying data back to the guest. Arbitrary heap memory relative to an allocated buffer can be disclosed. Se encontró una falla de lectura de memoria fuera de los límites en el dispositivo nvme virtual en QEMU. El proceso QEMU no valida un desplazamiento proporcionado por el invitado antes de calcular un puntero de la memoria del host, que se utiliza para copiar datos al invitado. • https://access.redhat.com/security/cve/CVE-2023-4135 https://bugzilla.redhat.com/show_bug.cgi?id=2229101 https://security.netapp.com/advisory/ntap-20230915-0012 https://www.zerodayinitiative.com/advisories/ZDI-CAN-21521 • CWE-125: Out-of-bounds Read •
CVSS: 6.5EPSS: 0%CPEs: 6EXPL: 0CVE-2023-3180 – Heap buffer overflow in virtio_crypto_sym_op_helper()
https://notcve.org/view.php?id=CVE-2023-3180
A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in virtio_crypto_handle_sym_req. There is no check for the value of `src_len` and `dst_len` in virtio_crypto_sym_op_helper, potentially leading to a heap buffer overflow when the two values differ. • https://access.redhat.com/security/cve/CVE-2023-3180 https://bugzilla.redhat.com/show_bug.cgi?id=2222424 https://lists.debian.org/debian-lts-announce/2023/10/msg00006.html https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MURWGXDIF2WTDXV36T6HFJDBL632AO7R https://security.netapp.com/advisory/ntap-20230831-0008 • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •