The vulnerability of the QEMU hardware emulation software, related to integer overflows, allows a hacker to trigger a service failure.

The vulnerability of the QEMU hardware emulation software is related to a numerical overflow condition. Exploiting this vulnerability allows an attacker to cause a system failure...

The vulnerability of the input/output requests for the mptsas_free_request() SCSI function in the QEMU hardware emulation software allows a attacker to cause a service failure.

The vulnerability of the input/output requests for the mptsasfreerequest function in the QEMU hardware emulation software is related to the use of memory after it is freed. Exploiting this vulnerability allows a attacker to cause a service failure...

Denial Of Service (DoS)

qemu is vulnerable to denial of service. The vulnerability exists due to an infinite loop in USB xHCI controller emulation of QEMU while computing the length of the Transfer Request Block TRB Ring...

Use After Free

qemu is vulnerable to a use-after-free. LSI53C895A SCSI Host Bus Adapter emulation of QEMU occurs while processing repeated messages to cancel the current SCSI request via the lsidomsgout function. This flaw allows a malicious privileged user within the guest to crash the QEMU process on the host...

GSD-2022-1006321 KVM: x86: Mark TSS busy during LTR emulation _after_ all fault checks

KVM: x86: Mark TSS busy during LTR emulation after all fault checks This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.9.326 by commit...

GSD-2022-1006279 KVM: x86: Mark TSS busy during LTR emulation _after_ all fault checks

KVM: x86: Mark TSS busy during LTR emulation after all fault checks This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.291 by commit...

GSD-2022-1006266 arm64: fix oops in concurrently setting insn_emulation sysctls

arm64: fix oops in concurrently setting insnemulation sysctls This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.14.291 by commit...

GSD-2022-1006187 KVM: x86: Mark TSS busy during LTR emulation _after_ all fault checks

KVM: x86: Mark TSS busy during LTR emulation after all fault checks This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v4.19.256 by commit...

GSD-2022-1005696 KVM: x86: Mark TSS busy during LTR emulation _after_ all fault checks

KVM: x86: Mark TSS busy during LTR emulation after all fault checks This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.61 by commit...

PT-2022-34537 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v4.14.291 Description: The issue is related to the KVM x86 emulation of the LTR instruction, where the TSS is marked busy after all fault checks. The actual impact and attack plausibility have not yet been prove...

PT-2022-34325 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions 3.17 through 5.4.210 Description: The issue is related to the KVM x86 component, specifically with the handling of the LTR emulation. The problem arises when marking the TSS busy during this emulation, potentially after...

The vulnerability of the QEMU hardware emulation software, related to pointer swapping errors, allows a hacker to trigger a service failure.

The vulnerability of the QEMU hardware emulation software is related to pointer assignment errors. Exploiting this vulnerability allows an attacker to trigger a service failure...

The vulnerability of QEMU’s emulation of USB devices allows a perpetrator to gain access to confidential data, compromise its integrity, and cause service failures.

The vulnerability of QEMU’s emulation of hardware devices involves an incorrect pointer being freed. Exploiting this vulnerability can allow a remote attacker to access confidential data, compromise its integrity, and cause service failures...

The vulnerability of the QEMU hardware emulation software, related to access to an uninitialized pointer, allows a hacker to trigger a service failure.

The vulnerability of the QEMU hardware emulation software is related to access to an uninitialized pointer. Exploiting this vulnerability can allow a malicious actor to cause a system failure...

DEBIAN-CVE-2022-2962

A DMA reentrancy issue was found in the Tulip device emulation in QEMU. When Tulip reads or writes to the rx/tx descriptor or copies the rx/tx frame, it doesn't check whether the destination address is its own MMIO address. This can cause the device to trigger MMIO handlers multiple times, possib...

AZL-35159 CVE-2022-2962 affecting package qemu for versions less than 6.2.0-18

A DMA reentrancy issue was found in the Tulip device emulation in QEMU. When Tulip reads or writes to the rx/tx descriptor or copies the rx/tx frame, it doesn't check whether the destination address is its own MMIO address. This can cause the device to trigger MMIO handlers multiple times, possib...

Design/Logic Flaw

A DMA reentrancy issue was found in the Tulip device emulation in QEMU. When Tulip reads or writes to the rx/tx descriptor or copies the rx/tx frame, it doesn't check whether the destination address is its own MMIO address. This can cause the device to trigger MMIO handlers multiple times, possib...

CVE-2022-2962

A DMA reentrancy issue was found in the Tulip device emulation in QEMU. When Tulip reads or writes to the rx/tx descriptor or copies the rx/tx frame, it doesn't check whether the destination address is its own MMIO address. This can cause the device to trigger MMIO handlers multiple times, possib...

CVE-2022-2962

A DMA reentrancy issue was found in the Tulip device emulation in QEMU. When Tulip reads or writes to the rx/tx descriptor or copies the rx/tx frame, it doesn't check whether the destination address is its own MMIO address. This can cause the device to trigger MMIO handlers multiple times, possib...

CVE-2022-2962: Uncontrolled Resource Consumption

A DMA reentrancy issue was found in the Tulip device emulation in QEMU. When Tulip reads or writes to the rx/tx descriptor or copies the rx/tx frame, it doesn't check whether the destination address is its own MMIO address. This can cause the device to trigger MMIO handlers multiple times, possib...