CVE-2022-4172
Summary
| CVE | CVE-2022-4172 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2022-11-29 18:15:00 UTC |
|---|
| Updated | 2023-11-07 03:57:00 UTC |
|---|
| Description | An integer overflow and buffer overflow issues were found in the ACPI Error Record Serialization Table (ERST) device of QEMU in the read_erst_record() and write_erst_record() functions. Both issues may allow the guest to overrun the host buffer allocated for the ERST memory device. A malicious guest could use these flaws to crash the QEMU process on the host. |
|---|
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|
| Operating System |
Fedoraproject |
Fedora |
37 |
All |
All |
All |
| Application |
Qemu |
Qemu |
7.0.0 |
- |
All |
All |
References
| Reference | Source | Link | Tags |
|---|
| [PATCH v2] hw/acpi/erst.c: Fix memory handling issues - Christian A. Ehrhardt |
|
lore.kernel.org |
|
| erst: undefined-behavior in memcpy in write_erst_record (#1268) · Issues · QEMU / QEMU · GitLab |
MISC |
gitlab.com |
|
| hw/acpi/erst.c: Fix memory handling issues (defb7098) · Commits · QEMU / QEMU · GitLab |
MISC |
gitlab.com |
|
| [PATCH v2] hw/acpi/erst.c: Fix memory handling issues - Christian A. Ehrhardt |
MISC |
lore.kernel.org |
|
| [SECURITY] Fedora 37 Update: qemu-7.0.0-12.fc37 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| [SECURITY] Fedora 37 Update: qemu-7.0.0-12.fc37 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| CVE-2022-4172 QEMU Vulnerability in NetApp Products | NetApp Product Security |
CONFIRM |
security.netapp.com |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 160408 Oracle Enterprise Linux Security Update for qemu (ELSA-2023-12065)
- 160453 Oracle Enterprise Linux Security Update for virt:kvm_utils (ELSA-2023-12108)
- 160507 Oracle Enterprise Linux Security Update for virt:kvm_utils2 (ELSA-2023-12195)
- 160590 Oracle Enterprise Linux Security Update for qemu-kvm (ELSA-2023-2162)
- 199428 Ubuntu Security Notification for QEMU Vulnerabilities (USN-6167-1)
- 241416 Red Hat Update for qemu-kvm security (RHSA-2023:2162)
- 283510 Fedora Security Update for qemu (FEDORA-2022-22b1f8dae2)
- 941043 AlmaLinux Security Update for qemu-kvm (ALSA-2023:2162)
