StarlingX

[Debian] High CVE: CVE-2022-1050 qemu: a use-after-free condition

Bug #2059901 reported by Yue Tao
256
This bug affects 1 person
Affects Status Importance Assigned to Milestone
StarlingX
Triaged
High
Unassigned

Bug Description

CVE-2022-1050: https://nvd.nist.gov/vuln/detail/CVE-2022-1050

A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to execute HW commands when shared buffers are not yet allocated, potentially leading to a use-after-free condition.

Base Score: High

Reference:

['qemu_1:5.2+dfsg-11+deb11u2_amd64.deb===>qemu_1:5.2+dfsg-11+deb11u3_amd64.deb', 'qemu-utils_1:5.2+dfsg-11+deb11u2_amd64.deb===>qemu-utils_1:5.2+dfsg-11+deb11u3_amd64.deb']

CVE References

Yue Tao (wrytao)
summary: - [Debian] High CVE: CVE-2022-1050 qemu: leading to a use-after-free
- condition
+ [Debian] High CVE: CVE-2022-1050 qemu: a use-after-free condition
Revision history for this message
Ghada Khalil (gkhalil) wrote :

Changing the target release to stx.10.0 since the r/stx.9.0 release branch is created and the team doesn't port CVE fixes to released branches.

tags: added: stx.10.0
removed: stx.9.0
To post a comment you must log in.
This report contains Public Security information  
Everyone can see this security related information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.