Quick Emulator (Qemu) built with the VirtFS, host directory sharing via Plan 9 File System (9pfs) support, is vulnerable to an improper access control issue. It could occur while accessing files on a shared host directory. A privileged user inside guest could use this flaw to access host file system beyond the shared folder and potentially escalating their privileges on a host.
Memory leak in the serialexitcore function in hw/char/serial.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory consumption and QEMU process crash) via a large number of device unplug operations.
Memory leak in the v9fslistxattr function in hw/9pfs/9p-xattr.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (memory consumption) via vectors involving the origvalue variable.
Quick Emulator(Qemu) built with the virtio-9p back-end support is vulnerable to a memory leakage issue. It could occur while doing a I/O operation via v9fscreate/v9fslcreate routine.
A privileged user/process inside guest could use this flaw to leak host memory resulting in Dos.
Upstream patch: --------------- -> https://lists.gnu.org/archive/html/qemu-devel/2017-03/msg05449.html
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2017/04/03/2
hw/display/cirrusvgarop.h in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) via vectors related to copying VGA data via the cirrusbitbltropfwdtransp and cirrusbitbltropfwd functions.
Last updated 24 July 2024
Quick emulator(Qemu) built with the SDHCI device emulation support is vulnerable to an infinite loop issue. It could occur while doing a multi block SDMA transfer via 'sdhcisdmatransfermultiblocks' routine.
A privileged user inside guest could use this flaw to crash the Qemu process resulting in DoS.
Upstream patch: --------------- -> https://lists.gnu.org/archive/html/qemu-devel/2017-02/msg02776.html
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2017/02/14/8