CVE-2022-0216
A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of QEMU. The flaw occurs while processing repeated messages...
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of QEMU. The flaw occurs while processing repeated messages to cancel the current SCSI request via the lsi_do_msgout function. This flaw allows a malicious privileged user within the guest to crash the QEMU process on the host, resulting in a denial of service.
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2022-0216 qemu 修正版: 1:5.2+dfsg-11+deb11u3
参照URL
- advisory github.com
- advisory lists.fedoraproject.org
- advisory nvd.nist.gov
- advisory starlabs.sg
- patch gitlab.com
- report bugzilla.redhat.com
- report gitlab.com
- web access.redhat.com