All errata/sisyphus/ALT-PU-2022-3083-2
ALT-PU-2022-3083-2

Package update qemu in branch sisyphus

Version7.1.0-alt1
Task#310014
Published2026-02-04
Max severityCRITICAL
Severity:

Closed issues (10)

BDU:2022-03599
MEDIUM5.3

Уязвимость функции lsi_do_msgout эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2022-06-23Modified: 2024-09-13
CVSS 3.xMEDIUM 5.3
CVSS:3.x/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:N/A:H
CVSS 2.0LOW 3.8
CVSS:2.0/AV:L/AC:H/Au:S/C:N/I:N/A:C
References
BDU:2022-04558
HIGH8.8

Уязвимость реализации функции address_space_translate_for_iotlb() эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании или выполнить произвольный код

Published: 2022-07-21Modified: 2023-10-20
CVSS 3.xHIGH 8.8
CVSS:3.x/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS 2.0MEDIUM 6.8
CVSS:2.0/AV:L/AC:L/Au:S/C:C/I:C/A:C
References
BDU:2023-04956
CRITICAL10.0

Уязвимость модуля of_dpa_cmd_add_l2_floo эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании и выполнить произвольный код

Published: 2023-08-29Modified: 2024-04-01
CVSS 3.xCRITICAL 10.0
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS 2.0CRITICAL 10.0
CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:C/A:C
References
BDU:2024-04482
LOW3.2

Уязвимость эмулятора аппаратного обеспечения QEMU, связанная с циклом с недостижимым условием выхода, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2024-06-13Modified: 2024-09-24
CVSS 3.xLOW 3.2
CVSS:3.x/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L
CVSS 2.0LOW 1.7
CVSS:2.0/AV:L/AC:L/Au:S/C:N/I:N/A:P
References
BDU:2024-07351
MEDIUM6.5

Уязвимость функций read_erst_record() и write_erst_record() эмулятора аппаратного обеспечения QEMU, позволяющая нарушителю вызвать отказ в обслуживании

Published: 2024-09-23Modified: 2024-11-06
CVSS 3.xMEDIUM 6.5
CVSS:3.x/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
CVSS 2.0MEDIUM 4.6
CVSS:2.0/AV:L/AC:L/Au:S/C:N/I:N/A:C
References
CVE-2020-14394
LOW3.2

An infinite loop flaw was found in the USB xHCI controller emulation of QEMU while computing the length of the Transfer Request Block (TRB) Ring. This flaw allows a privileged guest user to hang the QEMU process on the host, resulting in a denial of service.

Published: 2022-08-17Modified: 2024-11-21
CVSS 3.xLOW 3.2
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L
References
CVE-2022-0216
MEDIUM4.4

A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of QEMU. The flaw occurs while processing repeated messages to cancel the current SCSI request via the lsi_do_msgout function. This flaw allows a malicious privileged user within the guest to crash the QEMU process on the host, resulting in a denial of service.

Published: 2022-08-26Modified: 2024-11-21
CVSS 3.xMEDIUM 4.4
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
References
CVE-2022-35414
HIGH8.8

softmmu/physmem.c in QEMU through 7.0.0 can perform an uninitialized read on the translate_fail path, leading to an io_readx or io_writex crash. NOTE: a third party states that the Non-virtualization Use Case in the qemu.org reference applies here, i.e., "Bugs affecting the non-virtualization use case are not considered security bugs at this time.

Published: 2022-07-11Modified: 2024-11-21
CVSS 2.0MEDIUM 6.1
CVSS:2.0/AV:L/AC:L/Au:N/C:P/I:P/A:C
CVSS 3.xHIGH 8.8
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
References
CVE-2022-36648
CRITICAL10.0

The hardware emulation in the of_dpa_cmd_add_l2_flood of rocker device model in QEMU, as used in 7.0.0 and earlier, allows remote attackers to crash the host qemu and potentially execute code on the host via execute a malformed program in the guest OS. Note: This has been disputed by multiple third parties as not a valid vulnerability due to the rocker device not falling within the virtualization use case.

Published: 2023-08-22Modified: 2024-11-21
CVSS 3.xCRITICAL 10.0
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
CVE-2022-4172
MEDIUM6.5

An integer overflow and buffer overflow issues were found in the ACPI Error Record Serialization Table (ERST) device of QEMU in the read_erst_record() and write_erst_record() functions. Both issues may allow the guest to overrun the host buffer allocated for the ERST memory device. A malicious guest could use these flaws to crash the QEMU process on the host.

Published: 2022-11-29Modified: 2025-04-14
CVSS 3.xMEDIUM 6.5
CVSS:3.x/CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H
References