Browse CVEs

MEDIUM 5.4 CVE-2025-54566 hw/pci/pcie_sriov.c in QEMU through 10.0.3 has a migration state inconsistency, a related issue to CVE-2024-26327. Qemu after 10.0.3 Fix from $1,6002025-07-25 MEDIUM 5.4 CVE-2025-54567 hw/pci/pcie_sriov.c in QEMU through 10.0.3 mishandles the VF Enable bit write mask, a related issue to CVE-2024-26327. Qemu after 10.0.3 Fix from $1,6002025-07-25 HIGH 7.8 CVE-2024-7730 A heap buffer overflow was found in the virtio-snd device in QEMU. When reading input audio in the virtio-snd input callback, virtio_snd_pcm_in_cb, t… Qemu 9.1.0+ Fix from $1,9502024-11-14 MEDIUM 6.0 CVE-2024-3447 A heap-based buffer overflow was found in the SDHCI device emulation of QEMU. The bug is triggered when both `s->data_count` and the size of `s->fif… Qemu 7.2.11 / 8.2.3+ Fix from $1,6002024-11-14 HIGH 8.2 CVE-2024-6519 A use-after-free vulnerability was found in the QEMU LSI53C895A SCSI Host Bus Adapter emulation. This issue can lead to a crash or VM escape. Qemu Mitigation only Fix from $1,9502024-10-21 HIGH 8.8 CVE-2024-24474 QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less than the… Qemu 8.2.0+ Fix from $1,9502024-02-20 MEDIUM 6.0 CVE-2024-26328 An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c does not set NumVFs to PCI_SRIOV_TOTAL_VF, and thus interact… Qemu after 8.2.1 Fix from $1,6002024-02-19 MEDIUM 5.3 CVE-2024-26327 An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c mishandles the situation where a guest writes NumVFs greater… Qemu after 8.2.1 Fix from $1,6002024-02-19 HIGH 7.1 CVE-2023-2861 A flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. The 9pfs server did not prohibit opening special files on the host s… Qemu 8.1.0+ Fix from $1,9502023-12-06 MEDIUM 5.5 CVE-2023-42467 QEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset in hw/scsi/scsi-disk.c because scsi_disk_emulate_mode_select does not prevent … Qemu after 8.0.0 Fix from $1,6002023-09-11 CRITICAL 10.0 CVE-2022-36648 The hardware emulation in the of_dpa_cmd_add_l2_flood of rocker device model in QEMU, as used in 7.0.0 and earlier, allows remote attackers to crash … Qemu after 7.0.0 Fix from $2,3002023-08-22 MEDIUM 5.5 CVE-2023-40360 QEMU through 8.0.4 accesses a NULL pointer in nvme_directive_receive in hw/nvme/ctrl.c because there is no check for whether an endurance group is co… Qemu after 8.0.4 Fix from $1,6002023-08-14 HIGH 8.6 CVE-2022-3872 An off-by-one read/write issue was found in the SDHCI device of QEMU. It occurs when reading/writing the Buffer Data Port Register in sdhci_read_data… Qemu 7.1.0+ Fix from $1,9502022-11-07 HIGH 7.8 CVE-2022-2962 A DMA reentrancy issue was found in the Tulip device emulation in QEMU. When Tulip reads or writes to the rx/tx descriptor or copies the rx/tx frame,… Qemu after 7.1.0 Fix from $1,9502022-09-13 MEDIUM 6.5 CVE-2021-20295 It was discovered that the update for the virt:rhel module in the RHSA-2020:4676 (https://access.redhat.com/errata/RHSA-2020:4676) erratum released a… Qemu 4.2.0-34+ Fix from $1,6002022-04-01 HIGH 8.8 CVE-2022-1050 A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to execute HW commands when … Qemu 2.20.1+ Fix from $1,9502022-03-29 MEDIUM 5.5 CVE-2021-3947 A stack-buffer-overflow was found in QEMU in the NVME component. The flaw lies in nvme_changed_nslist() where a malicious guest controlling certain i… Qemu after 6.1.0 Fix from $1,6002022-02-18 MEDIUM 6.5 CVE-2020-27661 A divide-by-zero issue was found in dwc2_handle_packet in hw/usb/hcd-dwc2.c in the hcd-dwc2 USB host controller emulation of QEMU. A malicious guest … Qemu after 5.1.1 Fix from $1,6002021-06-02 HIGH 7.8 CVE-2013-4536 An user able to alter the savevm data (either on the disk or over the wire during migration) could use this flaw to to corrupt QEMU process memory on… Qemu 1.5.3+ Fix from $1,9502021-05-28 MEDIUM 6.7 CVE-2020-35506 A use-after-free vulnerability was found in the am53c974 SCSI host bus adapter emulation of QEMU in versions before 6.0.0 during the handling of the … Qemu 6.0.0+ Fix from $1,6002021-05-28 HIGH 8.2 CVE-2020-35517 A flaw was found in qemu. A host privilege escalation issue was found in the virtio-fs shared file system daemon where a privileged guest user is abl… Qemu after 5.2.50 Fix from $1,9502021-01-28 MEDIUM 6.5 CVE-2019-20808 In QEMU 4.1.0, an out-of-bounds read flaw was found in the ATI VGA implementation. It occurs in the ati_cursor_define() routine while handling MMIO w… Qemu Mitigation only Fix from $1,6002020-12-31 MEDIUM 6.5 CVE-2020-27616 ati_2d_blt in hw/display/ati_2d.c in QEMU 4.2.1 can encounter an outside-limits situation in a calculation. A guest can crash the QEMU process. Qemu Patch available Fix from $1,6002020-11-06 MEDIUM 5.5 CVE-2020-24352 An issue was discovered in QEMU through 5.1.0. An out-of-bounds memory access was found in the ATI VGA device implementation. This flaw occurs in the… Qemu after 4.2.1 Fix from $1,6002020-10-16 MEDIUM 5.5 CVE-2020-10702 A flaw was found in QEMU in the implementation of the Pointer Authentication (PAuth) support for ARM introduced in version 4.0 and fixed in version 5… Qemu 5.0.0+ Fix from $1,6002020-06-04 MEDIUM 5.5 CVE-2020-13791 hw/pci/pci.c in QEMU 4.2.0 allows guest OS users to trigger an out-of-bounds access by providing an address near the end of the PCI configuration spa… Qemu after 5.0.1 Fix from $1,6002020-06-04 MEDIUM 6.5 CVE-2020-10717 A potential DoS flaw was found in the virtio-fs shared file system daemon (virtiofsd) implementation of the QEMU version >= v5.0. Virtio-fs is meant … Qemu 5.0.1+ Fix from $1,6002020-05-04 MEDIUM 5.6 CVE-2020-11102 hw/net/tulip.c in QEMU 4.2.0 has a buffer overflow during the copying of tx/rx buffers because the frame size is not validated against the r/w data l… Qemu Mitigation only Fix from $1,6002020-04-06 MEDIUM 5.8 CVE-2019-15034 hw/display/bochs-display.c in QEMU 4.0.0 does not ensure a sufficient PCI config space allocation, leading to a buffer overflow involving the PCIe ex… Qemu Patch available Fix from $1,6002020-03-10 HIGH 7.5 CVE-2019-20175 An issue was discovered in ide_dma_cb() in hw/ide/core.c in QEMU 2.4.0 through 4.2.0. The guest system can crash the QEMU process in the host system … Qemu after 4.2.0 Fix from $1,9502019-12-31