Debian Qemu vulnerabilities

CVE-2016-7116 [MEDIUM] CVE-2016-7116: qemu - Directory traversal vulnerability in hw/9pfs/9p.c in QEMU (aka Quick Emulator) a... Directory traversal vulnerability in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to access host files outside the export path via a .. (dot dot) in an unspecified string. Scope: local bookworm: resolved (fixed in 1:2.6+dfsg-3.1) bullseye: resolved (fixed in 1:2.6+dfsg-3.1) forky: resolved (fixed in 1:2.6+dfsg-3.1) sid: resolved (fixed

CVE-2014-0150 [MEDIUM] CVE-2014-0150: qemu - Integer overflow in the virtio_net_handle_mac function in hw/net/virtio-net.c in... Integer overflow in the virtio_net_handle_mac function in hw/net/virtio-net.c in QEMU 2.0 and earlier allows local guest users to execute arbitrary code via a MAC addresses table update request, which triggers a heap-based buffer overflow. Scope: local bookworm: resolved (fixed in 1.7.0+dfsg-8) bullseye: resolved (fixed in 1.7.0+dfsg-8) forky: resolved (fixed in 1.7.0+

CVE-2007-1321 [HIGH] CVE-2007-1321: qemu - Integer signedness error in the NE2000 emulator in QEMU 0.8.2, as used in Xen an... Integer signedness error in the NE2000 emulator in QEMU 0.8.2, as used in Xen and possibly other products, allows local users to trigger a heap-based buffer overflow via certain register values that bypass sanity checks, aka QEMU NE2000 "receive" integer signedness error. NOTE: this identifier was inadvertently used by some sources to cover multiple issues that were labe

CVE-2014-2894 [HIGH] CVE-2014-2894: qemu - Off-by-one error in the cmd_smart function in the smart self test in hw/ide/core... Off-by-one error in the cmd_smart function in the smart self test in hw/ide/core.c in QEMU before 2.0 allows local users to have unspecified impact via a SMART EXECUTE OFFLINE command that triggers a buffer underflow and memory corruption. Scope: local bookworm: resolved (fixed in 2.0.0+dfsg-1) bullseye: resolved (fixed in 2.0.0+dfsg-1) forky: resolved (fixed in 2.0.0+df

CVE-2021-20196 [MEDIUM] CVE-2021-20196: qemu - A NULL pointer dereference flaw was found in the floppy disk emulator of QEMU. T... A NULL pointer dereference flaw was found in the floppy disk emulator of QEMU. This issue occurs while processing read/write ioport commands if the selected floppy drive is not initialized with a block device. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this vulnerability is

CVE-2021-3638 [MEDIUM] CVE-2021-3638: qemu - An out-of-bounds memory access flaw was found in the ATI VGA device emulation of... An out-of-bounds memory access flaw was found in the ATI VGA device emulation of QEMU. This flaw occurs in the ati_2d_blt() routine while handling MMIO write operations when the guest provides invalid values for the destination display parameters. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service. Scope: local

CVE-2016-9845 [MEDIUM] CVE-2016-9845: qemu - QEMU (aka Quick Emulator) built with the Virtio GPU Device emulator support is v... QEMU (aka Quick Emulator) built with the Virtio GPU Device emulator support is vulnerable to an information leakage issue. It could occur while processing 'VIRTIO_GPU_CMD_GET_CAPSET_INFO' command. A guest user/process could use this flaw to leak contents of the host memory bytes. Scope: local bookworm: resolved (fixed in 1:2.8+dfsg-1) bullseye: resolved (fixed in 1:2.8

CVE-2021-4145 [MEDIUM] CVE-2021-4145: qemu - A NULL pointer dereference issue was found in the block mirror layer of QEMU in ... A NULL pointer dereference issue was found in the block mirror layer of QEMU in versions prior to 6.2.0. The `self` pointer is dereferenced in mirror_wait_on_conflicts() without ensuring that it's not NULL. A malicious unprivileged user within the guest could use this flaw to crash the QEMU process on the host when writing data reaches the threshold of mirroring node.

CVE-2021-3582 [MEDIUM] CVE-2021-3582: qemu - A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device.... A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. The issue occurs while handling a "PVRDMA_CMD_CREATE_MR" command due to improper memory remapping (mremap). This flaw allows a malicious guest to crash the QEMU process on the host. The highest threat from this vulnerability is to system availability. Scope: local bookworm: resolved (fixed

CVE-2016-4020 [MEDIUM] CVE-2016-4020: qemu - The patch_instruction function in hw/i386/kvmvapic.c in QEMU does not initialize... The patch_instruction function in hw/i386/kvmvapic.c in QEMU does not initialize the imm32 variable, which allows local guest OS administrators to obtain sensitive information from host stack memory by accessing the Task Priority Register (TPR). Scope: local bookworm: resolved (fixed in 1:2.6+dfsg-2) bullseye: resolved (fixed in 1:2.6+dfsg-2) forky: resolved (fixed in

CVE-2021-20257 [MEDIUM] CVE-2021-20257: qemu - An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issu... An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx) descriptors in process_tx_desc if various descriptor fields are initialized with invalid values. This flaw allows a guest to consume CPU cycles on the host, resulting in a denial of service. The highest threat from this vulnerability is to system a

CVE-2024-3447 [MEDIUM] CVE-2024-3447: qemu - A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. Th... A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s->data_count` and the size of `s->fifo_buffer` are set to 0x200, leading to an out-of-bound access. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition. Scope: local bookworm: resolved (fixed

CVE-2023-3180 [MEDIUM] CVE-2023-3180: qemu - A flaw was found in the QEMU virtual crypto device while handling data encryptio... A flaw was found in the QEMU virtual crypto device while handling data encryption/decryption requests in virtio_crypto_handle_sym_req. There is no check for the value of `src_len` and `dst_len` in virtio_crypto_sym_op_helper, potentially leading to a heap buffer overflow when the two values differ. Scope: local bookworm: resolved (fixed in 1:7.2+dfsg-7+deb12u2) bullsey

CVE-2021-3947 [MEDIUM] CVE-2021-3947: qemu - A stack-buffer-overflow was found in QEMU in the NVME component. The flaw lies i... A stack-buffer-overflow was found in QEMU in the NVME component. The flaw lies in nvme_changed_nslist() where a malicious guest controlling certain input can read out of bounds memory. A malicious user could use this flaw leading to disclosure of sensitive information. Scope: local bookworm: resolved (fixed in 1:6.2+dfsg-1) bullseye: resolved forky: resolved (fixed in

CVE-2020-15863 [MEDIUM] CVE-2020-15863: qemu - hw/net/xgmac.c in the XGMAC Ethernet controller in QEMU before 07-20-2020 has a ... hw/net/xgmac.c in the XGMAC Ethernet controller in QEMU before 07-20-2020 has a buffer overflow. This occurs during packet transmission and affects the highbank and midway emulated machines. A guest user or process could use this flaw to crash the QEMU process on the host, resulting in a denial of service or potential privileged code execution. This was fixed in comm

CVE-2008-4553 [HIGH] CVE-2008-4553: qemu - qemu-make-debian-root in qemu 0.9.1-5 on Debian GNU/Linux allows local users to ... qemu-make-debian-root in qemu 0.9.1-5 on Debian GNU/Linux allows local users to overwrite arbitrary files via a symlink attack on temporary files and directories. Scope: local bookworm: resolved (fixed in 0.9.1-6) bullseye: resolved (fixed in 0.9.1-6) forky: resolved (fixed in 0.9.1-6) sid: resolved (fixed in 0.9.1-6) trixie: resolved (fixed in 0.9.1-6)

CVE-2019-3812 [MEDIUM] CVE-2019-3812: qemu - QEMU, through version 2.10 and through version 3.1.0, is vulnerable to an out-of... QEMU, through version 2.10 and through version 3.1.0, is vulnerable to an out-of-bounds read of up to 128 bytes in the hw/i2c/i2c-ddc.c:i2c_ddc() function. A local attacker with permission to execute i2c commands could exploit this to read stack memory of the qemu process on the host. Scope: local bookworm: resolved (fixed in 1:3.1+dfsg-5) bullseye: resolved (fixed in

CVE-2021-3544 [MEDIUM] CVE-2021-3544: qemu - Several memory leaks were found in the virtio vhost-user GPU device (vhost-user-... Several memory leaks were found in the virtio vhost-user GPU device (vhost-user-gpu) of QEMU in versions up to and including 6.0. They exist in contrib/vhost-user-gpu/vhost-user-gpu.c and contrib/vhost-user-gpu/virgl.c due to improper release of memory (i.e., free) after effective lifetime. Scope: local bookworm: resolved (fixed in 1:6.1+dfsg-1) bullseye: resolved (fix

CVE-2015-8613 [MEDIUM] CVE-2015-8613: qemu - Stack-based buffer overflow in the megasas_ctrl_get_info function in QEMU, when ... Stack-based buffer overflow in the megasas_ctrl_get_info function in QEMU, when built with SCSI MegaRAID SAS HBA emulation support, allows local guest users to cause a denial of service (QEMU instance crash) via a crafted SCSI controller CTRL_GET_INFO command. Scope: local bookworm: resolved (fixed in 1:2.5+dfsg-3) bullseye: resolved (fixed in 1:2.5+dfsg-3) forky: reso

CVE-2021-3930 [MEDIUM] CVE-2021-3930: qemu - An off-by-one error was found in the SCSI device emulation in QEMU. It could occ... An off-by-one error was found in the SCSI device emulation in QEMU. It could occur while processing MODE SELECT commands in mode_sense_page() if the 'page' argument was set to MODE_PAGE_ALLS (0x3f). A malicious guest could use this flaw to potentially crash QEMU, resulting in a denial of service condition. Scope: local bookworm: resolved (fixed in 1:6.2+dfsg-1) bullsey