CVE-2022-26353
QEMU: virtio-net: map leaking on error during receive
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
A flaw was found in the virtio-net device of QEMU. This flaw was inadvertently introduced with the fix for CVE-2021-3748, which forgot to unmap the cached virtqueue elements on error, leading to memory leakage and other unexpected results. Affected QEMU version: 6.2.0.
Se ha encontrado un fallo en el dispositivo virtio-net de QEMU. Este fallo fue introducido inadvertidamente con la corrección de CVE-2021-3748, que olvidaba desmapear los elementos de virtqueue almacenados en caché en caso de error, conllevando a pérdidas de memoria y otros resultados no esperados. Versión de QEMU afectada: 6.2.0
A flaw was found in the virtio-net device of QEMU. This flaw was inadvertently introduced with the fix for CVE-2021-3748, which forgot to unmap the cached virtqueue elements on error, leading to memory leakage, use-after-free or other unexpected results. A malicious privileged guest could exploit this issue to crash QEMU or potentially execute arbitrary code within the context of the QEMU process on the host.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2022-03-02 CVE Reserved
- 2022-03-16 CVE Published
- 2024-08-03 CVE Updated
- 2024-10-20 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-772: Missing Release of Resource after Effective Lifetime
CAPEC
References (7)
| URL | Tag | Source |
|---|---|---|
| https://security.netapp.com/advisory/ntap-20220425-0003 | Third Party Advisory |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://gitlab.com/qemu-project/qemu/-/commit/abe300d9d894f7138e1af7c8e9c88c04bfe98b37 | 2023-02-12 | |
| https://lists.nongnu.org/archive/html/qemu-devel/2022-03/msg02438.html | 2023-02-12 |
| URL | Date | SRC |
|---|---|---|
| https://security.gentoo.org/glsa/202208-27 | 2023-02-12 | |
| https://www.debian.org/security/2022/dsa-5133 | 2023-02-12 | |
| https://access.redhat.com/security/cve/CVE-2022-26353 | 2022-08-02 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2063197 | 2022-08-02 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Qemu Search vendor "Qemu" | Qemu Search vendor "Qemu" for product "Qemu" | 6.2.0 Search vendor "Qemu" for product "Qemu" and version "6.2.0" | - |
Affected
| ||||||
| Debian Search vendor "Debian" | Debian Linux Search vendor "Debian" for product "Debian Linux" | 11.0 Search vendor "Debian" for product "Debian Linux" and version "11.0" | - |
Affected
| ||||||