// For flags

CVE-2019-12155

QEMU: qxl: null pointer dereference while releasing spice resources

Severity Score

7.5
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

interface_release_resource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference.

interface_release_resource en hw/display/qxl.c en QEMU versión 3.1.x hasta la versión 4.0.0 tiene una desreferencia en puntero NULL.

It was discovered that the LSI SCSI adapter emulator implementation in QEMU did not properly validate executed scripts. A local attacker could use this to cause a denial of service. Sergej Schumilo, Cornelius Aschermann and Simon Woerner discovered that the qxl paravirtual graphics driver implementation in QEMU contained a null pointer dereference. A local attacker in a guest could use this to cause a denial of service. Various other issues were also addressed.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
None
Integrity
None
Availability
Low
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
None
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2019-05-17 CVE Reserved
  • 2019-05-24 CVE Published
  • 2024-08-04 CVE Updated
  • 2024-08-04 First Exploit
  • 2025-03-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-476: NULL Pointer Dereference
CAPEC
References (22)
URL Tag Source
https://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=3be7eb2f47bf71db5f80fcf8750ea395dd5ffdd2 X_refsource_misc
https://lists.debian.org/debian-lts-announce/2019/09/msg00021.html Mailing List
https://seclists.org/bugtraq/2019/May/76 Mailing List
URL Date SRC
http://www.openwall.com/lists/oss-security/2019/05/22/1 2024-08-04
URL Date SRC
https://lists.gnu.org/archive/html/qemu-devel/2019-05/msg01321.html 2023-11-07
URL Date SRC
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00000.html 2023-11-07
http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00008.html 2023-11-07
https://access.redhat.com/errata/RHBA-2019:3723 2023-11-07
https://access.redhat.com/errata/RHSA-2019:2607 2023-11-07
https://access.redhat.com/errata/RHSA-2019:2892 2023-11-07
https://access.redhat.com/errata/RHSA-2019:3179 2023-11-07
https://access.redhat.com/errata/RHSA-2019:3345 2023-11-07
https://access.redhat.com/errata/RHSA-2019:3742 2023-11-07
https://access.redhat.com/errata/RHSA-2019:3787 2023-11-07
https://access.redhat.com/errata/RHSA-2019:4344 2023-11-07
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BOE3PVFPMWMXV3DGP2R3XIHAF2ZQU3FS 2023-11-07
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RVDHJB2QKXNDU7OFXIHIL5O5VN5QCSZL 2023-11-07
https://usn.ubuntu.com/4191-1 2023-11-07
https://usn.ubuntu.com/4191-2 2023-11-07
https://www.debian.org/security/2019/dsa-4454 2023-11-07
https://access.redhat.com/security/cve/CVE-2019-12155 2020-03-31
https://bugzilla.redhat.com/show_bug.cgi?id=1712670 2020-03-31
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Qemu
Search vendor "Qemu"
 Qemu
Search vendor "Qemu" for product "Qemu"
 4.0.0
Search vendor "Qemu" for product "Qemu" and version "4.0.0"
-
Affected