Published: 29/11/2022 Updated: 07/11/2023

CVSS v3 Base Score: 6.5 | Impact Score: 4 | Exploitability Score: 2

VMScore: 0

An out-of-bounds read flaw was found in the QXL display device emulation in QEMU. The qxl_phys2virt() function does not check the size of the structure pointed to by the guest physical address, potentially reading past the end of the bar space into adjacent pages. A malicious guest user could use this flaw to crash the QEMU process on the host causing a denial of service condition.

Vulnerable Product	Search on Vulmon	Subscribe to Product
qemu qemu
fedoraproject extra packages for enterprise linux 8.0
fedoraproject fedora 37
redhat enterprise linux 8.0

Synopsis Moderate: virt:rhel and virt-devel:rhel security and bug fix update Type/Severity Security Advisory: Moderate Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the virt:rhel and virt-devel:rhel modules is now available for Red Hat Enterprise L ...

A NULL pointer dereference flaw was found in the floppy disk emulator of QEMU This issue occurs while processing read/write ioport commands if the selected floppy drive is not initialized with a block device This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service The highest threat from th ...

DescriptionAn out-of-bounds read flaw was found in the QXL display device emulation in QEMU The qxl_phys2virt() function does not check the size of the structure pointed to by the guest physical address, potentially reading past the end of the bar space into adjacent pages A malicious guest user could use this flaw to crash the QEMU proces ...

CWE-125 https://bugzilla.redhat.com/show_bug.cgi?id=2148506 https://lists.nongnu.org/archive/html/qemu-devel/2022-11/msg04143.html https://security.netapp.com/advisory/ntap-20230127-0012/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I7J5IRXJYLELW7D43A75LOWRUE5EU54O/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GTVPHLLXJ65BUMFBUUZ35F3J632SLFRK/https://access.redhat.com/errata/RHSA-2023:0432 https://nvd.nist.gov https://alas.aws.amazon.com/AL2/ALAS-2023-2061.html

CVE-2022-4144

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect