A DMA reentrancy issue was found in the Tulip device emulation in QEMU. When Tulip reads or writes to the rx/tx descriptor or copies the rx/tx frame it doesn't check whether the destination address is its own MMIO address. This can cause the device to trigger MMIO handlers multiple times possibly leading to a stack or heap overflow. A malicious guest could use this flaw to crash the QEMU process on the host resulting in a denial of service condition.

🗓️ 05 Aug 2024 07:00:00Reported by MicrosoftType

Tulip DMA reentrancy in the emulator risks repeated MMIO on rx and tx descriptors and frame copies, risking overflow and denial of service.

Reporter	Title	Published	Views	Family All 43
AlpineLinux	CVE-2022-2962	13 Sep 202219:18	–	alpinelinux
AstraLinux	Astra Linux - уязвимость в qemu	3 May 202623:59	–	astralinux
Tenable Nessus	Azure Linux 3.0 Security Update: qemu / qemu-kvm (CVE-2022-2962)	10 Feb 202500:00	–	nessus
Tenable Nessus	GLSA-202408-18 : QEMU: Multiple Vulnerabilities	9 Aug 202400:00	–	nessus
Tenable Nessus	CBL Mariner 2.0 Security Update: qemu / qemu-kvm (CVE-2022-2962)	6 Aug 202400:00	–	nessus
Tenable Nessus	TencentOS Server 4: qemu (TSSA-2024:0869)	16 Jun 202500:00	–	nessus
Tenable Nessus	Ubuntu 16.04 ESM / 18.04 LTS / 20.04 LTS / 22.04 LTS : QEMU vulnerabilities (USN-5772-1)	12 Dec 202200:00	–	nessus
CBLMariner	CVE-2022-2962 affecting package qemu-kvm 4.2.0-43	12 Jan 202320:55	–	cbl_mariner
CBLMariner	CVE-2022-2962 affecting package qemu for versions less than 6.2.0-13	17 Jan 202316:47	–	cbl_mariner
CBLMariner	CVE-2022-2962 affecting package qemu for versions less than 6.2.0-18	19 Mar 202417:21	–	cbl_mariner