CVE-2022-3872

Severity Score

8.6

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

An off-by-one read/write issue was found in the SDHCI device of QEMU. It occurs when reading/writing the Buffer Data Port Register in sdhci_read_dataport and sdhci_write_dataport, respectively, if data_count == block_size. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.

Se encontró un problema de lectura/escritura de uno en uno en el dispositivo SDHCI de QEMU. Ocurre al leer/escribir el registro del Puerto de Datos del Búfer en sdhci_read_dataport y sdhci_write_dataport, respectivamente, si data_count == block_size. Un invitado malintencionado podría utilizar esta falla para bloquear el proceso QEMU en el host, lo que resultaría en una condición de denegación de servicio.

*Credits: N/A

CVSS Scores

NISTv3.1 8.6

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

None

Integrity

None

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2022-11-07 CVE Reserved
2022-11-07 CVE Published
2024-05-30 EPSS Updated
2024-08-03 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-193: Off-by-one Error

CAPEC

References (2)

URL	Tag	Source
https://security.netapp.com/advisory/ntap-20221215-0005	Third Party Advisory

URL	Date	SRC

URL	Date	SRC
https://lists.nongnu.org/archive/html/qemu-devel/2022-11/msg01068.html	2023-02-23

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Qemu Search vendor "Qemu"		Qemu Search vendor "Qemu" for product "Qemu"				< 7.1.0 Search vendor "Qemu" for product "Qemu" and version " < 7.1.0"		-		Affected
Qemu Search vendor "Qemu"		Qemu Search vendor "Qemu" for product "Qemu"				7.1.0 Search vendor "Qemu" for product "Qemu" and version "7.1.0"		-		Affected
Qemu Search vendor "Qemu"		Qemu Search vendor "Qemu" for product "Qemu"				7.1.0 Search vendor "Qemu" for product "Qemu" and version "7.1.0"		rc0		Affected
Qemu Search vendor "Qemu"		Qemu Search vendor "Qemu" for product "Qemu"				7.1.0 Search vendor "Qemu" for product "Qemu" and version "7.1.0"		rc1		Affected
Qemu Search vendor "Qemu"		Qemu Search vendor "Qemu" for product "Qemu"				7.1.0 Search vendor "Qemu" for product "Qemu" and version "7.1.0"		rc2		Affected
Qemu Search vendor "Qemu"		Qemu Search vendor "Qemu" for product "Qemu"				7.1.0 Search vendor "Qemu" for product "Qemu" and version "7.1.0"		rc3		Affected
Qemu Search vendor "Qemu"		Qemu Search vendor "Qemu" for product "Qemu"				7.1.0 Search vendor "Qemu" for product "Qemu" and version "7.1.0"		rc4		Affected