StarlingX

[Debian] High CVE: CVE-2022-1050 qemu: a use-after-free condition

Bug #2059901 reported by Yue Tao
256
This bug affects 1 person
Affects Status Importance Assigned to Milestone
StarlingX
In Progress
High
Wentao Zhang

Bug Description

CVE-2022-1050: https://nvd.nist.gov/vuln/detail/CVE-2022-1050

A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to execute HW commands when shared buffers are not yet allocated, potentially leading to a use-after-free condition.

Base Score: High

Reference:

['qemu_1:5.2+dfsg-11+deb11u2_amd64.deb===>qemu_1:5.2+dfsg-11+deb11u3_amd64.deb', 'qemu-utils_1:5.2+dfsg-11+deb11u2_amd64.deb===>qemu-utils_1:5.2+dfsg-11+deb11u3_amd64.deb']

CVE References

Yue Tao (wrytao)
summary: - [Debian] High CVE: CVE-2022-1050 qemu: leading to a use-after-free
- condition
+ [Debian] High CVE: CVE-2022-1050 qemu: a use-after-free condition
Revision history for this message
Ghada Khalil (gkhalil) wrote :

Changing the target release to stx.10.0 since the r/stx.9.0 release branch is created and the team doesn't port CVE fixes to released branches.

tags: added: stx.10.0
removed: stx.9.0
Wentao Zhang (wzhang4)
Changed in starlingx:
assignee: nobody → Wentao Zhang (wzhang4)
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to virt (master)

Fix proposed to branch: master
Review: https://review.opendev.org/c/starlingx/virt/+/919664

Changed in starlingx:
status: Triaged → In Progress
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.