Qemu vulnerabilities
416 vulnerabilities
Known vulnerabilities in Qemu products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 4 products.
Products
3 of 4- Qemu416 vulnerabilities
- Display1 vulnerabilities
- Qemu (Virtio Rng)1 vulnerabilities
CVE-2018-16872canonicalubuntu_linux+7
EPSS score1.07%
A flaw was found in qemu Media Transfer Protocol (MTP). The code opening files in usb_mtp_get_object and usb_mtp_get_partial_object and directories in usb_mtp_object_readdir doesn't consider that the underlying filesystem may have changed since the time lstat(2) was called in usb_mtp_object_alloc, a classical TOCTTOU problem. An attacker with write access to the host filesystem shared with a guest can use this property to navigate the host filesystem in the context of the QEMU process and read any file the QEMU process has access to. Access to the filesystem may be local or via a network share protocol such as CIFS.CVE-2018-16867canonicalubuntu_linux+4EPSS score0.42%
A flaw was found in qemu Media Transfer Protocol (MTP) before version 3.1.0. A path traversal in the in usb_mtp_write_data function in hw/usb/dev-mtp.c due to an improper filename sanitization. When the guest device is mounted in read-write mode, this allows to read/write arbitrary files which may lead do DoS scenario OR possibly lead to code execution on the host.CVE-2018-16847canonicalubuntu_linux+6EPSS score0.54%
An OOB heap buffer r/w access issue was found in the NVM Express Controller emulation in QEMU. It could occur in nvme_cmb_ops routines in nvme device. A guest user/process could use this flaw to crash the QEMU process resulting in DoS or potentially run arbitrary code with privileges of the QEMU process.CVE-2018-19665debianqemu+3EPSS score0.94%
The Bluetooth subsystem in QEMU mishandles negative values for length variables, leading to memory corruption.CVE-2018-19364canonicalubuntu_linux+6EPSS score0.53%
hw/9pfs/cofile.c and hw/9pfs/9p.c in QEMU can modify an fid path while it is being accessed by a second thread, leading to (for example) a use-after-free outcome.CVE-2018-19489canonicalubuntu_linux+6EPSS score0.40%
v9fs_wstat in hw/9pfs/9p.c in QEMU allows guest OS users to cause a denial of service (crash) because of a race condition during file renaming.CVE-2018-11806canonicalubuntu_linux+22EPSS score0.81%
m_cat in slirp/mbuf.c in Qemu has a heap-based buffer overflow via incoming fragmented datagrams.CVE-2018-20124canonicalubuntu_linux+2EPSS score0.49%
hw/rdma/rdma_backend.c in QEMU allows guest OS users to trigger out-of-bounds access via a PvrdmaSqWqe ring element with a large num_sge value.CVE-2018-20123canonicalubuntu_linux+3EPSS score0.49%
pvrdma_realize in hw/rdma/vmw/pvrdma_main.c in QEMU has a Memory leak after an initialisation error.CVE-2018-20191canonicalubuntu_linux+3EPSS score3.72%
hw/rdma/vmw/pvrdma_main.c in QEMU does not implement a read operation (such as uar_read by analogy to uar_write), which allows attackers to cause a denial of service (NULL pointer dereference).CVE-2018-20126canonicalubuntu_linux+3EPSS score0.49%
hw/rdma/vmw/pvrdma_cmd.c in QEMU allows create_cq and create_qp memory leaks because errors are mishandled.CVE-2018-20815debianqemu+12EPSS score4.43%
In QEMU 3.1.0, load_device_tree in device_tree.c calls the deprecated load_image function, which has a buffer overflow risk.CVE-2018-20216canonicalubuntu_linux+2EPSS score3.88%
QEMU can have an infinite loop in hw/rdma/vmw/pvrdma_dev_ring.c because return values are not checked (and -1 is mishandled).CVE-2018-20125canonicalubuntu_linux+2EPSS score3.68%
hw/rdma/vmw/pvrdma_cmd.c in QEMU allows attackers to cause a denial of service (NULL pointer dereference or excessive memory allocation) in create_cq_ring or create_qp_rings.CVE-2018-17963canonicalubuntu_linux+7EPSS score4.65%
qemu_deliver_packet_iov in net/net.c in Qemu accepts packet sizes greater than INT_MAX, which allows attackers to cause a denial of service or possibly have unspecified other impact.CVE-2018-17962canonicalubuntu_linux+7EPSS score4.50%
Qemu has a Buffer Overflow in pcnet_receive in hw/net/pcnet.c because an incorrect integer data type is used.CVE-2018-17958canonicalubuntu_linux+6EPSS score6.29%
Qemu has a Buffer Overflow in rtl8139_do_receive in hw/net/rtl8139.c because an incorrect integer data type is used.CVE-2018-7550canonicalubuntu_linux+11EPSS score0.61%
The load_multiboot function in hw/i386/multiboot.c in Quick Emulator (aka QEMU) allows local guest OS users to execute arbitrary code on the QEMU host via a mh_load_end_addr value greater than mh_bss_end_addr, which triggers an out-of-bounds read or write memory access.CVE-2018-7858canonicalubuntu_linux+15EPSS score0.61%
Quick Emulator (aka QEMU), when built with the Cirrus CLGD 54xx VGA Emulator support, allows local guest OS privileged users to cause a denial of service (out-of-bounds access and QEMU process crash) by leveraging incorrect region calculation when updating VGA display.CVE-2018-18438chainguardqemu+31EPSS score0.44%
Qemu has integer overflows because IOReadHandler and its associated functions use a signed integer data type for a size value.