p PatchFirst

CVE-2022-2962

CVE-2022-2962

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A DMA reentrancy issue was found in the Tulip device emulation in QEMU. When Tulip reads or writes to the rx/tx descriptor or copies the rx/tx frame, it doesn't check whether the destination address is its own MMIO address. This can cause the device to trigger MMIO handlers multiple times, possibly leading to a stack or heap overflow. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.

CVSS 7.8 · High · EPSS 0.4% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • qemu

    Versions
    • Will be fixed in QEMU 7.2.0-rc0: Affected

    No fix published

  • qemu Debian:12

    Affected ranges
    • ECOSYSTEM: < 1:7.1+dfsg-2

    Update to 1:7.1+dfsg-2

  • qemu Debian:13

    Affected ranges
    • ECOSYSTEM: < 1:7.1+dfsg-2

    Update to 1:7.1+dfsg-2

  • qemu Debian:14

    Affected ranges
    • ECOSYSTEM: < 1:7.1+dfsg-2

    Update to 1:7.1+dfsg-2

Original sources

Check your server →