The hardware emulation in the of_dpa_cmd_add_l2_flood of rocker device model in QEMU as used in 7.0.0 and earlier allows remote attackers to crash the host qemu and potentially execute code on the host via execute a malformed program in the guest OS. Note: This has been disputed by multiple third parties as not a valid vulnerability due to the rocker device not falling within the virtualization use case.

🗓️ 05 Aug 2024 07:00:00Reported by MicrosoftType

Rocker device emulation of_dpa_cmd_add_l2_flood in QEMU before 7.0 may crash host and enable code execution; disputed.

Reporter	Title	Published	Views	Family All 25
ATTACKERKB	CVE-2022-36648	22 Aug 202319:16	–	attackerkb
Tenable Nessus	Azure Linux 3.0 Security Update: qemu (CVE-2022-36648)	10 Feb 202500:00	–	nessus
Tenable Nessus	CBL Mariner 2.0 Security Update: qemu (CVE-2022-36648)	6 Aug 202400:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2022-36648	6 Mar 202500:00	–	nessus
BDU FSTEC	The vulnerability of the _dpa_cmd_add_l2_floo module in the QEMU hardware emulation software allows a hacker to trigger a service failure and execute arbitrary code.	29 Aug 202300:00	–	bdu_fstec
CBLMariner	CVE-2022-36648 affecting package qemu for versions less than 6.2.0-17	13 Sep 202302:10	–	cbl_mariner
CBLMariner	CVE-2022-36648 affecting package qemu for versions less than 6.2.0-18	19 Mar 202417:21	–	cbl_mariner
Circl	CVE-2022-36648	22 Aug 202322:28	–	circl
CNNVD	QEMU 代码问题漏洞	22 Aug 202300:00	–	cnnvd
CVE	CVE-2022-36648	22 Aug 202300:00	–	cve