CVE-2022-0216
A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of QEMU. The flaw occurs while processing repeated messages...
Original description
The description as published by the source.
A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of QEMU. The flaw occurs while processing repeated messages to cancel the current SCSI request via the lsi_do_msgout function. This flaw allows a malicious privileged user within the guest to crash the QEMU process on the host, resulting in a denial of service.
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2022-0216 qemu Fixed in: 1:5.2+dfsg-11+deb11u3
References
- advisory github.com
- advisory lists.fedoraproject.org
- advisory nvd.nist.gov
- advisory starlabs.sg
- patch gitlab.com
- report bugzilla.redhat.com
- report gitlab.com
- web access.redhat.com