CVE-2022-4172
An integer overflow and buffer overflow issues were found in the ACPI Error Record Serialization Table (ERST) device of QEMU in the read_erst_record()...
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
An integer overflow and buffer overflow issues were found in the ACPI Error Record Serialization Table (ERST) device of QEMU in the read_erst_record() and write_erst_record() functions. Both issues may allow the guest to overrun the host buffer allocated for the ERST memory device. A malicious guest could use these flaws to crash the QEMU process on the host.
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2022-4172 qemu 修正版: 1:7.2+dfsg-1
参照URL
- advisory github.com
- advisory lists.fedoraproject.org
- advisory nvd.nist.gov
- advisory security.netapp.com
- patch gitlab.com
- report gitlab.com
- web lore.kernel.org