This issue occurs while processing controller commands due to a DMA reentry issue. A privileged guest user may use this flaw to crash the QEMU process on the host resulting in DoS scenario.Ī stack overflow via an infinite recursion vulnerability was found in the eepro100 i8255x device emulator of QEMU. It may occur if a guest was to supply invalid values for rx/tx queue size or other NIC parameters.
The highest threat from this vulnerability is to system availability.Īn integer overflow issue was found in the vmxnet3 NIC emulator of the QEMU for versions up to v5.2.0. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. This issue occurs while processing read/write ioport commands if the selected floppy drive is not initialized with a block device.
The highest threat from this vulnerability is to system availability.Ī NULL pointer dereference flaw was found in the floppy disk emulator of QEMU. This issue occurs in the megasas_command_cancelled() callback function while dropping a SCSI request. Hw/ide/pci.c in QEMU before 5.1.1 can trigger a NULL pointer dereference because it lacks a pointer check before an ide_cancel_dma_sync call.Ī NULL pointer dereference flaw was found in the megasas-gen2 SCSI host bus adapter emulation of QEMU in versions before and including 6.0. Pci_change_irq_level in hw/pci/pci.c in QEMU before 5.1.1 has a NULL pointer dereference because pci_get_bus() might not return a valid pointer. The ahci_commit_buf function in ide/ahci.c in QEMU allows attackers to cause a denial of service (NULL dereference) when the command header 'ad->cur_cmd' is null.įdctrl_write_data in hw/block/fdc.c in QEMU 5.0.0 has a NULL pointer dereference via a NULL block pointer for the current drive. A privileged guest user could use this flaw to crash the QEMU process on the host resulting in DoS scenario, or potential information leakage from the host memory. It could occur in fdctrl_transfer_handler() in hw/block/fdc.c while processing DMA read data transfers from the floppy drive to the guest system. A heap buffer overflow was found in the floppy disk emulator of QEMU up to 6.0.0 (including).
0 kommentar(er)
