CVE-2022-4144

Description

An out-of-bounds read flaw was found in the QXL display device emulation in QEMU. The qxl_phys2virt() function does not check the size of the structure pointed to by the guest physical address, potentially reading past the end of the bar space into adjacent pages. A malicious guest user could use this flaw to crash the QEMU process on the host causing a denial of service condition.

CVSS Metrics

• v3.1•MEDIUM•Score: 6.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.29%• Percentile: 22%

Techniques & Countermeasures

• CWE-125•Out-of-bounds Read

  The product reads data past the end, or before the beginning, of the intended buffer.

Affected Systems

• debian•qemu

  all | < 1:7.2+dfsg-1 | < 1:7.2+dfsg-1 | < 1:7.2+dfsg-1

• fedoraproject•extra_packages_for_enterprise_linux

  8.0

• fedoraproject•fedora

  37

• qemu•qemu

  ≤ 7.1.0

• redhat•enterprise_linux

  8.0

• redhat•hivex

  < 0:1.3.18-23.module+el8.7.0+16689+53d59bc2 | < 0:1.3.18-23.module+el8.7.0+16689+53d59bc2 | < 0:1.3.18-23.module+el8.6.0+14480+c0a3aa0f | < 0:1.3.18-23.module+el8.6.0+14480+c0a3aa0f

• redhat•hivex-debuginfo

  < 0:1.3.18-23.module+el8.7.0+16689+53d59bc2 | < 0:1.3.18-23.module+el8.7.0+16689+53d59bc2 | < 0:1.3.18-23.module+el8.6.0+14480+c0a3aa0f | < 0:1.3.18-23.module+el8.6.0+14480+c0a3aa0f

• redhat•hivex-debugsource

  < 0:1.3.18-23.module+el8.7.0+16689+53d59bc2 | < 0:1.3.18-23.module+el8.7.0+16689+53d59bc2 | < 0:1.3.18-23.module+el8.6.0+14480+c0a3aa0f | < 0:1.3.18-23.module+el8.6.0+14480+c0a3aa0f

• redhat•hivex-devel

  < 0:1.3.18-23.module+el8.7.0+16689+53d59bc2 | < 0:1.3.18-23.module+el8.7.0+16689+53d59bc2 | < 0:1.3.18-23.module+el8.6.0+14480+c0a3aa0f | < 0:1.3.18-23.module+el8.6.0+14480+c0a3aa0f

• redhat•libguestfs

  < 1:1.44.0-9.module+el8.7.0+16689+53d59bc2 | < 1:1.44.0-5.module+el8.6.0+14480+c0a3aa0f

• redhat•libguestfs-appliance

  < 1:1.44.0-9.module+el8.7.0+16689+53d59bc2 | < 1:1.44.0-5.module+el8.6.0+14480+c0a3aa0f

• redhat•libguestfs-bash-completion

  < 1:1.44.0-9.module+el8.7.0+16689+53d59bc2 | < 1:1.44.0-5.module+el8.6.0+14480+c0a3aa0f

• redhat•libguestfs-debuginfo

  < 1:1.44.0-9.module+el8.7.0+16689+53d59bc2 | < 1:1.44.0-5.module+el8.6.0+14480+c0a3aa0f

• redhat•libguestfs-debugsource

  < 1:1.44.0-9.module+el8.7.0+16689+53d59bc2 | < 1:1.44.0-5.module+el8.6.0+14480+c0a3aa0f

• redhat•libguestfs-devel

  < 1:1.44.0-9.module+el8.7.0+16689+53d59bc2 | < 1:1.44.0-5.module+el8.6.0+14480+c0a3aa0f

• redhat•libguestfs-gfs2

  < 1:1.44.0-9.module+el8.7.0+16689+53d59bc2 | < 1:1.44.0-5.module+el8.6.0+14480+c0a3aa0f

• redhat•libguestfs-gobject

  < 1:1.44.0-9.module+el8.7.0+16689+53d59bc2 | < 1:1.44.0-5.module+el8.6.0+14480+c0a3aa0f

• redhat•libguestfs-gobject-debuginfo

  < 1:1.44.0-9.module+el8.7.0+16689+53d59bc2 | < 1:1.44.0-5.module+el8.6.0+14480+c0a3aa0f

• redhat•libguestfs-gobject-devel

  < 1:1.44.0-9.module+el8.7.0+16689+53d59bc2 | < 1:1.44.0-5.module+el8.6.0+14480+c0a3aa0f

• redhat•libguestfs-inspect-icons

  < 1:1.44.0-9.module+el8.7.0+16689+53d59bc2 | < 1:1.44.0-5.module+el8.6.0+14480+c0a3aa0f

• redhat•libguestfs-java

  < 1:1.44.0-9.module+el8.7.0+16689+53d59bc2 | < 1:1.44.0-5.module+el8.6.0+14480+c0a3aa0f

• redhat•libguestfs-java-debuginfo

  < 1:1.44.0-9.module+el8.7.0+16689+53d59bc2 | < 1:1.44.0-5.module+el8.6.0+14480+c0a3aa0f

• redhat•libguestfs-java-devel

  < 1:1.44.0-9.module+el8.7.0+16689+53d59bc2 | < 1:1.44.0-5.module+el8.6.0+14480+c0a3aa0f

• redhat•libguestfs-javadoc

  < 1:1.44.0-9.module+el8.7.0+16689+53d59bc2 | < 1:1.44.0-5.module+el8.6.0+14480+c0a3aa0f

• redhat•libguestfs-man-pages-ja

  < 1:1.44.0-9.module+el8.7.0+16689+53d59bc2 | < 1:1.44.0-5.module+el8.6.0+14480+c0a3aa0f

• redhat•libguestfs-man-pages-uk

  < 1:1.44.0-9.module+el8.7.0+16689+53d59bc2 | < 1:1.44.0-5.module+el8.6.0+14480+c0a3aa0f

• redhat•libguestfs-rescue

  < 1:1.44.0-9.module+el8.7.0+16689+53d59bc2 | < 1:1.44.0-5.module+el8.6.0+14480+c0a3aa0f

• redhat•libguestfs-rsync

  < 1:1.44.0-9.module+el8.7.0+16689+53d59bc2 | < 1:1.44.0-5.module+el8.6.0+14480+c0a3aa0f

• redhat•libguestfs-tools

  < 1:1.44.0-9.module+el8.7.0+16689+53d59bc2 | < 1:1.44.0-5.module+el8.6.0+14480+c0a3aa0f

• redhat•libguestfs-tools-c

  < 1:1.44.0-9.module+el8.7.0+16689+53d59bc2 | < 1:1.44.0-5.module+el8.6.0+14480+c0a3aa0f

• redhat•libguestfs-tools-c-debuginfo

  < 1:1.44.0-9.module+el8.7.0+16689+53d59bc2 | < 1:1.44.0-5.module+el8.6.0+14480+c0a3aa0f

• redhat•libguestfs-winsupport

  < 0:8.6-1.module+el8.7.0+16689+53d59bc2 | < 0:8.6-1.module+el8.7.0+16689+53d59bc2 | < 0:8.6-1.module+el8.6.0+14480+c0a3aa0f | < 0:8.6-1.module+el8.6.0+14480+c0a3aa0f

• redhat•libguestfs-xfs

  < 1:1.44.0-9.module+el8.7.0+16689+53d59bc2 | < 1:1.44.0-5.module+el8.6.0+14480+c0a3aa0f

• redhat•libiscsi

  < 0:1.18.0-8.module+el8.7.0+16689+53d59bc2 | < 0:1.18.0-8.module+el8.7.0+16689+53d59bc2 | < 0:1.18.0-8.module+el8.6.0+14480+c0a3aa0f | < 0:1.18.0-8.module+el8.6.0+14480+c0a3aa0f

• redhat•libiscsi-debuginfo

  < 0:1.18.0-8.module+el8.7.0+16689+53d59bc2 | < 0:1.18.0-8.module+el8.7.0+16689+53d59bc2 | < 0:1.18.0-8.module+el8.6.0+14480+c0a3aa0f | < 0:1.18.0-8.module+el8.6.0+14480+c0a3aa0f

• redhat•libiscsi-debugsource

  < 0:1.18.0-8.module+el8.7.0+16689+53d59bc2 | < 0:1.18.0-8.module+el8.7.0+16689+53d59bc2 | < 0:1.18.0-8.module+el8.6.0+14480+c0a3aa0f | < 0:1.18.0-8.module+el8.6.0+14480+c0a3aa0f

• redhat•libiscsi-devel

  < 0:1.18.0-8.module+el8.7.0+16689+53d59bc2 | < 0:1.18.0-8.module+el8.7.0+16689+53d59bc2 | < 0:1.18.0-8.module+el8.6.0+14480+c0a3aa0f | < 0:1.18.0-8.module+el8.6.0+14480+c0a3aa0f

• redhat•libiscsi-utils

  < 0:1.18.0-8.module+el8.7.0+16689+53d59bc2 | < 0:1.18.0-8.module+el8.7.0+16689+53d59bc2 | < 0:1.18.0-8.module+el8.6.0+14480+c0a3aa0f | < 0:1.18.0-8.module+el8.6.0+14480+c0a3aa0f

• redhat•libiscsi-utils-debuginfo

  < 0:1.18.0-8.module+el8.7.0+16689+53d59bc2 | < 0:1.18.0-8.module+el8.7.0+16689+53d59bc2 | < 0:1.18.0-8.module+el8.6.0+14480+c0a3aa0f | < 0:1.18.0-8.module+el8.6.0+14480+c0a3aa0f

• redhat•libnbd

  < 0:1.6.0-5.module+el8.7.0+16689+53d59bc2 | < 0:1.6.0-5.module+el8.7.0+16689+53d59bc2 | < 0:1.6.0-5.module+el8.6.0+14480+c0a3aa0f | < 0:1.6.0-5.module+el8.6.0+14480+c0a3aa0f

• redhat•libnbd-bash-completion

  < 0:1.6.0-5.module+el8.7.0+16689+53d59bc2 | < 0:1.6.0-5.module+el8.6.0+14480+c0a3aa0f

• redhat•libnbd-debuginfo

  < 0:1.6.0-5.module+el8.7.0+16689+53d59bc2 | < 0:1.6.0-5.module+el8.7.0+16689+53d59bc2 | < 0:1.6.0-5.module+el8.6.0+14480+c0a3aa0f | < 0:1.6.0-5.module+el8.6.0+14480+c0a3aa0f

• redhat•libnbd-debugsource

  < 0:1.6.0-5.module+el8.7.0+16689+53d59bc2 | < 0:1.6.0-5.module+el8.7.0+16689+53d59bc2 | < 0:1.6.0-5.module+el8.6.0+14480+c0a3aa0f | < 0:1.6.0-5.module+el8.6.0+14480+c0a3aa0f

• redhat•libnbd-devel

  < 0:1.6.0-5.module+el8.7.0+16689+53d59bc2 | < 0:1.6.0-5.module+el8.7.0+16689+53d59bc2 | < 0:1.6.0-5.module+el8.6.0+14480+c0a3aa0f | < 0:1.6.0-5.module+el8.6.0+14480+c0a3aa0f

• redhat•libtpms

  < 0:0.9.1-1.20211126git1ff6fe1f43.module+el8.7.0+16689+53d59bc2 | < 0:0.9.1-0.20211126git1ff6fe1f43.module+el8.6.0+14480+c0a3aa0f

• redhat•libtpms-debuginfo

  < 0:0.9.1-1.20211126git1ff6fe1f43.module+el8.7.0+16689+53d59bc2 | < 0:0.9.1-0.20211126git1ff6fe1f43.module+el8.6.0+14480+c0a3aa0f

• redhat•libtpms-debugsource

  < 0:0.9.1-1.20211126git1ff6fe1f43.module+el8.7.0+16689+53d59bc2 | < 0:0.9.1-0.20211126git1ff6fe1f43.module+el8.6.0+14480+c0a3aa0f

• redhat•libtpms-devel

  < 0:0.9.1-1.20211126git1ff6fe1f43.module+el8.7.0+16689+53d59bc2 | < 0:0.9.1-0.20211126git1ff6fe1f43.module+el8.6.0+14480+c0a3aa0f

• redhat•libvirt

  < 0:8.0.0-10.1.module+el8.7.0+17192+cbc2449b | < 0:8.0.0-10.1.module+el8.7.0+17192+cbc2449b | < 0:8.0.0-5.6.module+el8.6.0+17751+d6559882 | < 0:8.0.0-5.6.module+el8.6.0+17751+d6559882

• redhat•libvirt-client

  < 0:8.0.0-10.1.module+el8.7.0+17192+cbc2449b | < 0:8.0.0-10.1.module+el8.7.0+17192+cbc2449b | < 0:8.0.0-5.6.module+el8.6.0+17751+d6559882 | < 0:8.0.0-5.6.module+el8.6.0+17751+d6559882

Showing first 50 affected entries in server-rendered view.

References (18)

• https://bugzilla.redhat.com/show_bug.cgi?id=2148506
• https://lists.nongnu.org/archive/html/qemu-devel/2022-11/msg04143.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I7J5IRXJYLELW7D43A75LOWRUE5EU54O/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTVPHLLXJ65BUMFBUUZ35F3J632SLFRK/
• https://security.netapp.com/advisory/ntap-20230127-0012/
• https://security-tracker.debian.org/tracker/CVE-2022-4144
• https://access.redhat.com/errata/RHSA-2023:0099
• https://access.redhat.com/security/updates/classification/#moderate
• https://bugzilla.redhat.com/show_bug.cgi?id=2132176
• https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0099.json
• https://access.redhat.com/security/cve/CVE-2022-4144
• https://www.cve.org/CVERecord?id=CVE-2022-4144
• https://nvd.nist.gov/vuln/detail/CVE-2022-4144
• https://access.redhat.com/errata/RHSA-2023:0432
• https://bugzilla.redhat.com/show_bug.cgi?id=2152080
• https://bugzilla.redhat.com/show_bug.cgi?id=2154413
• https://bugzilla.redhat.com/show_bug.cgi?id=2157092
• https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0432.json