CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-1050 – Ubuntu Security Notice USN-6167-1
https://notcve.org/view.php?id=CVE-2022-1050
29 Mar 2022 — A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to execute HW commands when shared buffers are not yet allocated, potentially leading to a use-after-free condition. Se ha encontrado un fallo en la implementación de QEMU del dispositivo RDMA paravirtual de VMWare. Este defecto permite que un controlador de huésped crafteado ejecute comandos HW cuando los búferes compartidos aún no están asignados, lo que puede llevar a una condición de ... • https://bugzilla.redhat.com/show_bug.cgi?id=2069625 • CWE-416: Use After Free •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 1CVE-2021-3582 – Gentoo Linux Security Advisory 202208-27
https://notcve.org/view.php?id=CVE-2021-3582
25 Mar 2022 — A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. The issue occurs while handling a "PVRDMA_CMD_CREATE_MR" command due to improper memory remapping (mremap). This flaw allows a malicious guest to crash the QEMU process on the host. The highest threat from this vulnerability is to system availability. Se ha encontrado un fallo en la implementación de QEMU del dispositivo RDMA paravirtual de VMWare. • https://bugzilla.redhat.com/show_bug.cgi?id=1966266 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 3.2EPSS: 0%CPEs: 3EXPL: 0CVE-2022-26354 – QEMU: vhost-vsock: missing virtqueue detach on error can lead to memory leak
https://notcve.org/view.php?id=CVE-2022-26354
16 Mar 2022 — A flaw was found in the vhost-vsock device of QEMU. In case of error, an invalid element was not detached from the virtqueue before freeing its memory, leading to memory leakage and other unexpected results. Affected QEMU versions <= 6.2.0. Se ha encontrado un fallo en el dispositivo vhost-vsock de QEMU. En caso de error, un elemento inválido no era desprendido de la virtqueue antes de liberar su memoria, conllevando a una pérdida de memoria y otros resultados no esperados. • https://gitlab.com/qemu-project/qemu/-/commit/8d1b247f3748ac4078524130c6d7ae42b6140aaf • CWE-772: Missing Release of Resource after Effective Lifetime •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-0358 – QEMU: virtiofsd: potential privilege escalation via CVE-2018-13405
https://notcve.org/view.php?id=CVE-2022-0358
28 Feb 2022 — A flaw was found in the QEMU virtio-fs shared file system daemon (virtiofsd) implementation. This flaw is strictly related to CVE-2018-13405. A local guest user can create files in the directories shared by virtio-fs with unintended group ownership in a scenario where a directory is SGID to a certain group and is writable by a user who is not a member of the group. This could allow a malicious unprivileged user inside the guest to gain access to resources accessible to the root group, potentially escalating... • https://access.redhat.com/security/cve/CVE-2022-0358 • CWE-273: Improper Check for Dropped Privileges •
CVSS: 6.0EPSS: 0%CPEs: 3EXPL: 0CVE-2021-3607 – Gentoo Linux Security Advisory 202208-27
https://notcve.org/view.php?id=CVE-2021-3607
24 Feb 2022 — An integer overflow was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions prior to 6.1.0. The issue occurs while handling a "PVRDMA_REG_DSRHIGH" write from the guest due to improper input validation. This flaw allows a privileged guest user to make QEMU allocate a large amount of memory, resulting in a denial of service. The highest threat from this vulnerability is to system availability. Se encontró un desbordamiento de enteros en la implementación de QEMU del dispositivo RD... • https://bugzilla.redhat.com/show_bug.cgi?id=1973349 • CWE-190: Integer Overflow or Wraparound •
CVSS: 6.5EPSS: 0%CPEs: 12EXPL: 0CVE-2021-3930 – QEMU: off-by-one error in mode_sense_page() in hw/scsi/scsi-disk.c
https://notcve.org/view.php?id=CVE-2021-3930
10 Dec 2021 — An off-by-one error was found in the SCSI device emulation in QEMU. It could occur while processing MODE SELECT commands in mode_sense_page() if the 'page' argument was set to MODE_PAGE_ALLS (0x3f). A malicious guest could use this flaw to potentially crash QEMU, resulting in a denial of service condition. Se ha encontrado un error "off-by-one" en la emulación de dispositivos SCSI en QEMU. Podía ocurrir mientras eran procesados comandos MODE SELECT en mode_sense_page() si el argumento "page" era establecido... • https://bugzilla.redhat.com/show_bug.cgi?id=2020588 • CWE-193: Off-by-one Error •
CVSS: 7.5EPSS: 0%CPEs: 9EXPL: 0CVE-2021-3748 – QEMU: virtio-net: heap use-after-free in virtio_net_receive_rcu
https://notcve.org/view.php?id=CVE-2021-3748
28 Oct 2021 — A use-after-free vulnerability was found in the virtio-net device of QEMU. It could occur when the descriptor's address belongs to the non direct access region, due to num_buffers being set after the virtqueue elem has been unmapped. A malicious guest could use this flaw to crash QEMU, resulting in a denial of service condition, or potentially execute code on the host with the privileges of the QEMU process. Se ha encontrado una vulnerabilidad de uso de memoria previamente liberada en el dispositivo virtio-... • https://bugzilla.redhat.com/show_bug.cgi?id=1998514 • CWE-416: Use After Free •
CVSS: 7.4EPSS: 0%CPEs: 4EXPL: 0CVE-2021-3713 – Debian Security Advisory 4980-1
https://notcve.org/view.php?id=CVE-2021-3713
25 Aug 2021 — An out-of-bounds write flaw was found in the UAS (USB Attached SCSI) device emulation of QEMU in versions prior to 6.2.0-rc0. The device uses the guest supplied stream number unchecked, which can lead to out-of-bounds access to the UASDevice->data3 and UASDevice->status3 fields. A malicious guest user could use this flaw to crash QEMU or potentially achieve code execution with the privileges of the QEMU process on the host. Se ha detectado un fallo de escritura fuera de límites en la emulación del dispositi... • https://bugzilla.redhat.com/show_bug.cgi?id=1994640 • CWE-787: Out-of-bounds Write •
CVSS: 8.5EPSS: 0%CPEs: 7EXPL: 0CVE-2021-3682 – QEMU: usbredir: free() call on invalid pointer in bufp_alloc()
https://notcve.org/view.php?id=CVE-2021-3682
05 Aug 2021 — A flaw was found in the USB redirector device emulation of QEMU in versions prior to 6.1.0-rc2. It occurs when dropping packets during a bulk transfer from a SPICE client due to the packet queue being full. A malicious SPICE client could use this flaw to make QEMU call free() with faked heap chunk metadata, resulting in a crash of QEMU or potential code execution with the privileges of the QEMU process on the host. Se ha encontrado un fallo en la emulación del dispositivo redirector USB de QEMU en versiones... • https://bugzilla.redhat.com/show_bug.cgi?id=1989651 • CWE-763: Release of Invalid Pointer or Reference •
CVSS: 6.0EPSS: 0%CPEs: 3EXPL: 0CVE-2021-3608 – Ubuntu Security Notice USN-5010-1
https://notcve.org/view.php?id=CVE-2021-3608
15 Jul 2021 — A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device in versions prior to 6.1.0. The issue occurs while handling a "PVRDMA_REG_DSRHIGH" write from the guest and may result in a crash of QEMU or cause undefined behavior due to the access of an uninitialized pointer. The highest threat from this vulnerability is to system availability. Se ha encontrado un fallo en la implementación de QEMU del dispositivo RDMA paravirtual de VMWare en versiones anteriores a 6.1.0. El problema es pro... • https://bugzilla.redhat.com/show_bug.cgi?id=1973383 • CWE-824: Access of Uninitialized Pointer •