{"id":"CVE-2022-0216","aliases":["DEBIAN-CVE-2022-0216","DLA-3362-1","EUVD-2022-15418","GHSA-jr85-6g96-46pc","OESA-2022-1907","SUSE-SU-2022:3594-1","SUSE-SU-2022:3660-1","SUSE-SU-2022:3768-1","SUSE-SU-2022:3795-1","SUSE-SU-2023:0761-1","SUSE-SU-2023:0840-1","SUSE-SU-2023:2358-1","SUSE-SU-2024:1395-1","UBUNTU-CVE-2022-0216","USN-5772-1","openSUSE-SU-2024:12209-1"],"status":"published","title":"A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of...","description":"A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of QEMU. The flaw occurs while processing repeated messages to cancel the current SCSI request via the lsi_do_msgout function. This flaw allows a malicious privileged user within the guest to crash the QEMU process on the host, resulting in a denial of service.","severity":{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00432,"percentile":0.37914,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2022-08-26T00:00:00Z","modified":"2026-11-03T08:00:51Z","fixes":[{"ecosystem":"Debian:12","package":"qemu","fixed_in":["1:7.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"qemu","fixed_in":["1:7.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"qemu","fixed_in":["1:7.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"qemu","fixed_in":["4.1.0-69.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"qemu","fixed_in":["4.1.0-73.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"qemu","fixed_in":["6.2.0-48.oe2203"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"qemu","fixed_in":["2.0.0+dfsg-2ubuntu1.47+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"qemu","fixed_in":["1:2.5+dfsg-5ubuntu10.51+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"qemu","fixed_in":["1:2.11+dfsg-1ubuntu7.41"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"qemu","fixed_in":["1:4.2-3ubuntu6.24"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"qemu","fixed_in":["1:6.2+dfsg-2ubuntu6.6"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1+dfsg-8+deb10u10"}]}],"versions":["1:3.1+dfsg-8","1:3.1+dfsg-8+deb10u2","1:3.1+dfsg-8+deb10u3","1:3.1+dfsg-8+deb10u4","1:3.1+dfsg-8+deb10u5","1:3.1+dfsg-8+deb10u6","1:3.1+dfsg-8+deb10u7","1:3.1+dfsg-8+deb10u8","1:3.1+dfsg-8+deb10u9","1:3.1+dfsg-8~deb10u1"],"bundled":10},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.0-69.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.0-73.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-48.oe2203"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-150200.69.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-150200.69.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-150200.69.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-150200.69.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-150200.69.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-150200.69.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-150200.69.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-150200.69.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-150200.69.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-150200.69.1"}]}],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-150200.69.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.118.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.118.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.118.3"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.118.3"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.118.3"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.118.3"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"qemu-linux-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.118.2"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"qemu-testsuite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.118.5"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1.1-150100.80.43.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1.1-150100.80.43.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1.1-150100.80.43.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1.1-150100.80.43.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1.1-150100.80.43.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1.1-150100.80.43.2"}]}],"bundled":7},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1.1-150100.80.43.2"}]}],"bundled":7},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP4","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.8.2"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"qemu-linux-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"qemu-testsuite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.8.4"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1.1-66.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1.1-66.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.121.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.121.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.121.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.121.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.121.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.121.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.121.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.121.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.121.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.121.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2-BCL","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.6.2-41.76.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1.1-72.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1.1-72.1"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0+dfsg-2ubuntu1.47+esm2"}]}],"versions":["1.5.0+dfsg-3ubuntu5","1.5.0+dfsg-3ubuntu6","1.6.0+dfsg-2ubuntu1","1.6.0+dfsg-2ubuntu2","1.6.0+dfsg-2ubuntu3","1.6.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu1","1.7.0+dfsg-2ubuntu2","1.7.0+dfsg-2ubuntu3","1.7.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu5","1.7.0+dfsg-2ubuntu7","1.7.0+dfsg-2ubuntu8","1.7.0+dfsg-2ubuntu9","1.7.0+dfsg-3ubuntu1~ppa1","1.7.0+dfsg-3ubuntu1","1.7.0+dfsg-3ubuntu2","1.7.0+dfsg-3ubuntu3","1.7.0+dfsg-3ubuntu4","1.7.0+dfsg-3ubuntu5","1.7.0+dfsg-3ubuntu6","1.7.0+dfsg-3ubuntu7","2.0.0~rc1+dfsg-0ubuntu1","2.0.0~rc1+dfsg-0ubuntu2","2.0.0~rc1+dfsg-0ubuntu3","2.0.0~rc1+dfsg-0ubuntu3.1","2.0.0+dfsg-2ubuntu1","2.0.0+dfsg-2ubuntu1.1","2.0.0+dfsg-2ubuntu1.2","2.0.0+dfsg-2ubuntu1.3","2.0.0+dfsg-2ubuntu1.5","2.0.0+dfsg-2ubuntu1.6","2.0.0+dfsg-2ubuntu1.7","2.0.0+dfsg-2ubuntu1.8","2.0.0+dfsg-2ubuntu1.9","2.0.0+dfsg-2ubuntu1.10","2.0.0+dfsg-2ubuntu1.11","2.0.0+dfsg-2ubuntu1.13","2.0.0+dfsg-2ubuntu1.14","2.0.0+dfsg-2ubuntu1.15","2.0.0+dfsg-2ubuntu1.16","2.0.0+dfsg-2ubuntu1.17","2.0.0+dfsg-2ubuntu1.18","2.0.0+dfsg-2ubuntu1.19","2.0.0+dfsg-2ubuntu1.20","2.0.0+dfsg-2ubuntu1.21","2.0.0+dfsg-2ubuntu1.22","2.0.0+dfsg-2ubuntu1.24","2.0.0+dfsg-2ubuntu1.25","2.0.0+dfsg-2ubuntu1.26","2.0.0+dfsg-2ubuntu1.27","2.0.0+dfsg-2ubuntu1.28","2.0.0+dfsg-2ubuntu1.29","2.0.0+dfsg-2ubuntu1.30","2.0.0+dfsg-2ubuntu1.31","2.0.0+dfsg-2ubuntu1.32","2.0.0+dfsg-2ubuntu1.33","2.0.0+dfsg-2ubuntu1.34","2.0.0+dfsg-2ubuntu1.35","2.0.0+dfsg-2ubuntu1.36","2.0.0+dfsg-2ubuntu1.38","2.0.0+dfsg-2ubuntu1.39","2.0.0+dfsg-2ubuntu1.40","2.0.0+dfsg-2ubuntu1.41","2.0.0+dfsg-2ubuntu1.42","2.0.0+dfsg-2ubuntu1.43","2.0.0+dfsg-2ubuntu1.44","2.0.0+dfsg-2ubuntu1.45","2.0.0+dfsg-2ubuntu1.46","2.0.0+dfsg-2ubuntu1.47","2.0.0+dfsg-2ubuntu1.47+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.5+dfsg-5ubuntu10.51+esm1"}]}],"versions":["1:2.3+dfsg-5ubuntu9","1:2.3+dfsg-5ubuntu10","1:2.4+dfsg-4ubuntu1","1:2.4+dfsg-4ubuntu2","1:2.4+dfsg-4ubuntu3","1:2.4+dfsg-5ubuntu3","1:2.5+dfsg-1ubuntu2","1:2.5+dfsg-1ubuntu3","1:2.5+dfsg-1ubuntu4","1:2.5+dfsg-1ubuntu5","1:2.5+dfsg-5ubuntu1","1:2.5+dfsg-5ubuntu2","1:2.5+dfsg-5ubuntu4","1:2.5+dfsg-5ubuntu6","1:2.5+dfsg-5ubuntu7","1:2.5+dfsg-5ubuntu10","1:2.5+dfsg-5ubuntu10.1","1:2.5+dfsg-5ubuntu10.2","1:2.5+dfsg-5ubuntu10.3","1:2.5+dfsg-5ubuntu10.4","1:2.5+dfsg-5ubuntu10.5","1:2.5+dfsg-5ubuntu10.6","1:2.5+dfsg-5ubuntu10.7","1:2.5+dfsg-5ubuntu10.8","1:2.5+dfsg-5ubuntu10.9","1:2.5+dfsg-5ubuntu10.10","1:2.5+dfsg-5ubuntu10.11","1:2.5+dfsg-5ubuntu10.13","1:2.5+dfsg-5ubuntu10.14","1:2.5+dfsg-5ubuntu10.15","1:2.5+dfsg-5ubuntu10.16","1:2.5+dfsg-5ubuntu10.20","1:2.5+dfsg-5ubuntu10.21","1:2.5+dfsg-5ubuntu10.22","1:2.5+dfsg-5ubuntu10.24","1:2.5+dfsg-5ubuntu10.25","1:2.5+dfsg-5ubuntu10.26","1:2.5+dfsg-5ubuntu10.28","1:2.5+dfsg-5ubuntu10.29","1:2.5+dfsg-5ubuntu10.30","1:2.5+dfsg-5ubuntu10.31","1:2.5+dfsg-5ubuntu10.32","1:2.5+dfsg-5ubuntu10.33","1:2.5+dfsg-5ubuntu10.34","1:2.5+dfsg-5ubuntu10.35","1:2.5+dfsg-5ubuntu10.36","1:2.5+dfsg-5ubuntu10.37","1:2.5+dfsg-5ubuntu10.38","1:2.5+dfsg-5ubuntu10.39","1:2.5+dfsg-5ubuntu10.40","1:2.5+dfsg-5ubuntu10.41","1:2.5+dfsg-5ubuntu10.42","1:2.5+dfsg-5ubuntu10.43","1:2.5+dfsg-5ubuntu10.44","1:2.5+dfsg-5ubuntu10.45","1:2.5+dfsg-5ubuntu10.46","1:2.5+dfsg-5ubuntu10.47","1:2.5+dfsg-5ubuntu10.48","1:2.5+dfsg-5ubuntu10.49","1:2.5+dfsg-5ubuntu10.51"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.11+dfsg-1ubuntu7.41"}]}],"versions":["1:2.10+dfsg-0ubuntu3","1:2.10+dfsg-0ubuntu4","1:2.10+dfsg-0ubuntu5","1:2.11+dfsg-1ubuntu1","1:2.11+dfsg-1ubuntu2","1:2.11+dfsg-1ubuntu4","1:2.11+dfsg-1ubuntu5","1:2.11+dfsg-1ubuntu6","1:2.11+dfsg-1ubuntu7","1:2.11+dfsg-1ubuntu7.1","1:2.11+dfsg-1ubuntu7.2","1:2.11+dfsg-1ubuntu7.3","1:2.11+dfsg-1ubuntu7.4","1:2.11+dfsg-1ubuntu7.5","1:2.11+dfsg-1ubuntu7.6","1:2.11+dfsg-1ubuntu7.7","1:2.11+dfsg-1ubuntu7.8","1:2.11+dfsg-1ubuntu7.9","1:2.11+dfsg-1ubuntu7.10","1:2.11+dfsg-1ubuntu7.12","1:2.11+dfsg-1ubuntu7.13","1:2.11+dfsg-1ubuntu7.14","1:2.11+dfsg-1ubuntu7.15","1:2.11+dfsg-1ubuntu7.17","1:2.11+dfsg-1ubuntu7.18","1:2.11+dfsg-1ubuntu7.19","1:2.11+dfsg-1ubuntu7.20","1:2.11+dfsg-1ubuntu7.21","1:2.11+dfsg-1ubuntu7.22","1:2.11+dfsg-1ubuntu7.23","1:2.11+dfsg-1ubuntu7.25","1:2.11+dfsg-1ubuntu7.26","1:2.11+dfsg-1ubuntu7.27","1:2.11+dfsg-1ubuntu7.28","1:2.11+dfsg-1ubuntu7.29","1:2.11+dfsg-1ubuntu7.31","1:2.11+dfsg-1ubuntu7.32","1:2.11+dfsg-1ubuntu7.33","1:2.11+dfsg-1ubuntu7.34","1:2.11+dfsg-1ubuntu7.35","1:2.11+dfsg-1ubuntu7.36","1:2.11+dfsg-1ubuntu7.37","1:2.11+dfsg-1ubuntu7.38","1:2.11+dfsg-1ubuntu7.39","1:2.11+dfsg-1ubuntu7.40"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2-3ubuntu6.24"}]}],"versions":["1:4.0+dfsg-0ubuntu9","1:4.0+dfsg-0ubuntu10","1:4.2-1ubuntu1","1:4.2-1ubuntu2","1:4.2-3ubuntu1","1:4.2-3ubuntu2","1:4.2-3ubuntu3","1:4.2-3ubuntu4","1:4.2-3ubuntu5","1:4.2-3ubuntu6","1:4.2-3ubuntu6.1","1:4.2-3ubuntu6.2","1:4.2-3ubuntu6.3","1:4.2-3ubuntu6.4","1:4.2-3ubuntu6.5","1:4.2-3ubuntu6.6","1:4.2-3ubuntu6.7","1:4.2-3ubuntu6.8","1:4.2-3ubuntu6.9","1:4.2-3ubuntu6.10","1:4.2-3ubuntu6.11","1:4.2-3ubuntu6.12","1:4.2-3ubuntu6.14","1:4.2-3ubuntu6.15","1:4.2-3ubuntu6.16","1:4.2-3ubuntu6.17","1:4.2-3ubuntu6.18","1:4.2-3ubuntu6.19","1:4.2-3ubuntu6.21","1:4.2-3ubuntu6.23"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.2+dfsg-2ubuntu6.6"}]}],"versions":["1:6.0+dfsg-2expubuntu1","1:6.0+dfsg-2expubuntu2","1:6.0+dfsg-2expubuntu4","1:6.2+dfsg-2ubuntu5","1:6.2+dfsg-2ubuntu6","1:6.2+dfsg-2ubuntu6.1","1:6.2+dfsg-2ubuntu6.2","1:6.2+dfsg-2ubuntu6.3","1:6.2+dfsg-2ubuntu6.4","1:6.2+dfsg-2ubuntu6.5"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0+dfsg-2ubuntu1.47+esm2"}]}],"versions":["1.5.0+dfsg-3ubuntu5","1.5.0+dfsg-3ubuntu6","1.6.0+dfsg-2ubuntu1","1.6.0+dfsg-2ubuntu2","1.6.0+dfsg-2ubuntu3","1.6.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu1","1.7.0+dfsg-2ubuntu2","1.7.0+dfsg-2ubuntu3","1.7.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu5","1.7.0+dfsg-2ubuntu7","1.7.0+dfsg-2ubuntu8","1.7.0+dfsg-2ubuntu9","1.7.0+dfsg-3ubuntu1~ppa1","1.7.0+dfsg-3ubuntu1","1.7.0+dfsg-3ubuntu2","1.7.0+dfsg-3ubuntu3","1.7.0+dfsg-3ubuntu4","1.7.0+dfsg-3ubuntu5","1.7.0+dfsg-3ubuntu6","1.7.0+dfsg-3ubuntu7","2.0.0~rc1+dfsg-0ubuntu1","2.0.0~rc1+dfsg-0ubuntu2","2.0.0~rc1+dfsg-0ubuntu3","2.0.0~rc1+dfsg-0ubuntu3.1","2.0.0+dfsg-2ubuntu1","2.0.0+dfsg-2ubuntu1.1","2.0.0+dfsg-2ubuntu1.2","2.0.0+dfsg-2ubuntu1.3","2.0.0+dfsg-2ubuntu1.5","2.0.0+dfsg-2ubuntu1.6","2.0.0+dfsg-2ubuntu1.7","2.0.0+dfsg-2ubuntu1.8","2.0.0+dfsg-2ubuntu1.9","2.0.0+dfsg-2ubuntu1.10","2.0.0+dfsg-2ubuntu1.11","2.0.0+dfsg-2ubuntu1.13","2.0.0+dfsg-2ubuntu1.14","2.0.0+dfsg-2ubuntu1.15","2.0.0+dfsg-2ubuntu1.16","2.0.0+dfsg-2ubuntu1.17","2.0.0+dfsg-2ubuntu1.18","2.0.0+dfsg-2ubuntu1.19","2.0.0+dfsg-2ubuntu1.20","2.0.0+dfsg-2ubuntu1.21","2.0.0+dfsg-2ubuntu1.22","2.0.0+dfsg-2ubuntu1.24","2.0.0+dfsg-2ubuntu1.25","2.0.0+dfsg-2ubuntu1.26","2.0.0+dfsg-2ubuntu1.27","2.0.0+dfsg-2ubuntu1.28","2.0.0+dfsg-2ubuntu1.29","2.0.0+dfsg-2ubuntu1.30","2.0.0+dfsg-2ubuntu1.31","2.0.0+dfsg-2ubuntu1.32","2.0.0+dfsg-2ubuntu1.33","2.0.0+dfsg-2ubuntu1.34","2.0.0+dfsg-2ubuntu1.35","2.0.0+dfsg-2ubuntu1.36","2.0.0+dfsg-2ubuntu1.38","2.0.0+dfsg-2ubuntu1.39","2.0.0+dfsg-2ubuntu1.40","2.0.0+dfsg-2ubuntu1.41","2.0.0+dfsg-2ubuntu1.42","2.0.0+dfsg-2ubuntu1.43","2.0.0+dfsg-2ubuntu1.44","2.0.0+dfsg-2ubuntu1.45","2.0.0+dfsg-2ubuntu1.46","2.0.0+dfsg-2ubuntu1.47","2.0.0+dfsg-2ubuntu1.47+esm1"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.5+dfsg-5ubuntu10.51+esm1"}]}],"versions":["1:2.3+dfsg-5ubuntu9","1:2.3+dfsg-5ubuntu10","1:2.4+dfsg-4ubuntu1","1:2.4+dfsg-4ubuntu2","1:2.4+dfsg-4ubuntu3","1:2.4+dfsg-5ubuntu3","1:2.5+dfsg-1ubuntu2","1:2.5+dfsg-1ubuntu3","1:2.5+dfsg-1ubuntu4","1:2.5+dfsg-1ubuntu5","1:2.5+dfsg-5ubuntu1","1:2.5+dfsg-5ubuntu2","1:2.5+dfsg-5ubuntu4","1:2.5+dfsg-5ubuntu6","1:2.5+dfsg-5ubuntu7","1:2.5+dfsg-5ubuntu10","1:2.5+dfsg-5ubuntu10.1","1:2.5+dfsg-5ubuntu10.2","1:2.5+dfsg-5ubuntu10.3","1:2.5+dfsg-5ubuntu10.4","1:2.5+dfsg-5ubuntu10.5","1:2.5+dfsg-5ubuntu10.6","1:2.5+dfsg-5ubuntu10.7","1:2.5+dfsg-5ubuntu10.8","1:2.5+dfsg-5ubuntu10.9","1:2.5+dfsg-5ubuntu10.10","1:2.5+dfsg-5ubuntu10.11","1:2.5+dfsg-5ubuntu10.13","1:2.5+dfsg-5ubuntu10.14","1:2.5+dfsg-5ubuntu10.15","1:2.5+dfsg-5ubuntu10.16","1:2.5+dfsg-5ubuntu10.20","1:2.5+dfsg-5ubuntu10.21","1:2.5+dfsg-5ubuntu10.22","1:2.5+dfsg-5ubuntu10.24","1:2.5+dfsg-5ubuntu10.25","1:2.5+dfsg-5ubuntu10.26","1:2.5+dfsg-5ubuntu10.28","1:2.5+dfsg-5ubuntu10.29","1:2.5+dfsg-5ubuntu10.30","1:2.5+dfsg-5ubuntu10.31","1:2.5+dfsg-5ubuntu10.32","1:2.5+dfsg-5ubuntu10.33","1:2.5+dfsg-5ubuntu10.34","1:2.5+dfsg-5ubuntu10.35","1:2.5+dfsg-5ubuntu10.36","1:2.5+dfsg-5ubuntu10.37","1:2.5+dfsg-5ubuntu10.38","1:2.5+dfsg-5ubuntu10.39","1:2.5+dfsg-5ubuntu10.40","1:2.5+dfsg-5ubuntu10.41","1:2.5+dfsg-5ubuntu10.42","1:2.5+dfsg-5ubuntu10.43","1:2.5+dfsg-5ubuntu10.44","1:2.5+dfsg-5ubuntu10.45","1:2.5+dfsg-5ubuntu10.46","1:2.5+dfsg-5ubuntu10.47","1:2.5+dfsg-5ubuntu10.48","1:2.5+dfsg-5ubuntu10.49","1:2.5+dfsg-5ubuntu10.51"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.11+dfsg-1ubuntu7.41"}]}],"versions":["1:2.10+dfsg-0ubuntu3","1:2.10+dfsg-0ubuntu4","1:2.10+dfsg-0ubuntu5","1:2.11+dfsg-1ubuntu1","1:2.11+dfsg-1ubuntu2","1:2.11+dfsg-1ubuntu4","1:2.11+dfsg-1ubuntu5","1:2.11+dfsg-1ubuntu6","1:2.11+dfsg-1ubuntu7","1:2.11+dfsg-1ubuntu7.1","1:2.11+dfsg-1ubuntu7.2","1:2.11+dfsg-1ubuntu7.3","1:2.11+dfsg-1ubuntu7.4","1:2.11+dfsg-1ubuntu7.5","1:2.11+dfsg-1ubuntu7.6","1:2.11+dfsg-1ubuntu7.7","1:2.11+dfsg-1ubuntu7.8","1:2.11+dfsg-1ubuntu7.9","1:2.11+dfsg-1ubuntu7.10","1:2.11+dfsg-1ubuntu7.12","1:2.11+dfsg-1ubuntu7.13","1:2.11+dfsg-1ubuntu7.14","1:2.11+dfsg-1ubuntu7.15","1:2.11+dfsg-1ubuntu7.17","1:2.11+dfsg-1ubuntu7.18","1:2.11+dfsg-1ubuntu7.19","1:2.11+dfsg-1ubuntu7.20","1:2.11+dfsg-1ubuntu7.21","1:2.11+dfsg-1ubuntu7.22","1:2.11+dfsg-1ubuntu7.23","1:2.11+dfsg-1ubuntu7.25","1:2.11+dfsg-1ubuntu7.26","1:2.11+dfsg-1ubuntu7.27","1:2.11+dfsg-1ubuntu7.28","1:2.11+dfsg-1ubuntu7.29","1:2.11+dfsg-1ubuntu7.31","1:2.11+dfsg-1ubuntu7.32","1:2.11+dfsg-1ubuntu7.33","1:2.11+dfsg-1ubuntu7.34","1:2.11+dfsg-1ubuntu7.35","1:2.11+dfsg-1ubuntu7.36","1:2.11+dfsg-1ubuntu7.37","1:2.11+dfsg-1ubuntu7.38","1:2.11+dfsg-1ubuntu7.39","1:2.11+dfsg-1ubuntu7.40"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2-3ubuntu6.24"}]}],"versions":["1:4.0+dfsg-0ubuntu9","1:4.0+dfsg-0ubuntu10","1:4.2-1ubuntu1","1:4.2-1ubuntu2","1:4.2-3ubuntu1","1:4.2-3ubuntu2","1:4.2-3ubuntu3","1:4.2-3ubuntu4","1:4.2-3ubuntu5","1:4.2-3ubuntu6","1:4.2-3ubuntu6.1","1:4.2-3ubuntu6.2","1:4.2-3ubuntu6.3","1:4.2-3ubuntu6.4","1:4.2-3ubuntu6.5","1:4.2-3ubuntu6.6","1:4.2-3ubuntu6.7","1:4.2-3ubuntu6.8","1:4.2-3ubuntu6.9","1:4.2-3ubuntu6.10","1:4.2-3ubuntu6.11","1:4.2-3ubuntu6.12","1:4.2-3ubuntu6.14","1:4.2-3ubuntu6.15","1:4.2-3ubuntu6.16","1:4.2-3ubuntu6.17","1:4.2-3ubuntu6.18","1:4.2-3ubuntu6.19","1:4.2-3ubuntu6.21","1:4.2-3ubuntu6.23"],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.2+dfsg-2ubuntu6.6"}]}],"versions":["1:6.0+dfsg-2expubuntu1","1:6.0+dfsg-2expubuntu2","1:6.0+dfsg-2expubuntu4","1:6.2+dfsg-2ubuntu5","1:6.2+dfsg-2ubuntu6","1:6.2+dfsg-2ubuntu6.1","1:6.2+dfsg-2ubuntu6.2","1:6.2+dfsg-2ubuntu6.3","1:6.2+dfsg-2ubuntu6.4","1:6.2+dfsg-2ubuntu6.5"],"bundled":5},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.0-53.1"}]}],"bundled":6}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"qemu","product":"qemu"}],"references":[{"url":"https://starlabs.sg/advisories/22/22-0216/","tags":["x_transferred","Exploit","Third Party Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2036953","tags":["x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://gitlab.com/qemu-project/qemu/-/issues/972","tags":["x_transferred","Exploit","Third Party Advisory","report"]},{"url":"https://gitlab.com/qemu-project/qemu/-/commit/4367a20cc4","tags":["x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-0216","tags":["x_transferred","Third Party Advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZTY7TVHX62OJWF6IOBCIGLR2N5K4QN3E/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0216","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZTY7TVHX62OJWF6IOBCIGLR2N5K4QN3E/"},{"url":"https://github.com/advisories/GHSA-jr85-6g96-46pc"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/0xxx/CVE-2022-0216.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-0216","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1907","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223594-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1175144","tags":["report"]},{"url":"https://bugzilla.suse.com/1182282","tags":["report"]},{"url":"https://bugzilla.suse.com/1192115","tags":["report"]},{"url":"https://bugzilla.suse.com/1198035","tags":["report"]},{"url":"https://bugzilla.suse.com/1198037","tags":["report"]},{"url":"https://bugzilla.suse.com/1198038","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3409","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-4206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-4207","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-35414","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223660-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1201367","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223768-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1185000","tags":["report"]},{"url":"https://bugzilla.suse.com/1192463","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-17380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3507","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20223795-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230761-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1172033","tags":["report"]},{"url":"https://bugzilla.suse.com/1172382","tags":["report"]},{"url":"https://bugzilla.suse.com/1180207","tags":["report"]},{"url":"https://bugzilla.suse.com/1193880","tags":["report"]},{"url":"https://bugzilla.suse.com/1197653","tags":["report"]},{"url":"https://bugzilla.suse.com/1198712","tags":["report"]},{"url":"https://bugzilla.suse.com/1205808","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13253","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14394","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3929","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-26354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-4144","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230840-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1202364","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232358-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1187529","tags":["report"]},{"url":"https://bugzilla.suse.com/1193621","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241395-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1190011","tags":["report"]},{"url":"https://bugzilla.suse.com/1207205","tags":["report"]},{"url":"https://bugzilla.suse.com/1212850","tags":["report"]},{"url":"https://bugzilla.suse.com/1213925","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-0330","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-3180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-3354","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-0216","tags":["report"]},{"url":"https://starlabs.sg/advisories/22-0216","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5772-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-0216","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3682","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3750","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3930","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-2962","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-3165","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2022-26353","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-0216","description":"A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of QEMU. The flaw occurs while processing repeated messages to cancel the current SCSI request via the lsi_do_msgout function. This flaw allows a malicious privileged user within the guest to crash the QEMU process on the host, resulting in a denial of service.","status":"published","published":"2022-08-26T00:00:00Z","modified":"2024-08-02T23:18:42.831Z","cwes":["CWE-416"],"updated_at":"2026-11-02T14:34:41.69911Z"}],"euvd":[{"id":"EUVD-2022-15418","description":"A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of QEMU. The flaw occurs while processing repeated messages to cancel the current SCSI request via the lsi_do_msgout function. This flaw allows a malicious privileged user within the guest to crash the QEMU process on the host, resulting in a denial of service.","status":"published","published":"2022-08-26T00:00:00Z","modified":"2024-08-02T23:18:42Z","updated_at":"2026-11-03T03:26:06.080876Z"}],"ghsa":[{"id":"GHSA-jr85-6g96-46pc","title":"A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of...","description":"A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of QEMU. The flaw occurs while processing repeated messages to cancel the current SCSI request via the lsi_do_msgout function. This flaw allows a malicious privileged user within the guest to crash the QEMU process on the host, resulting in a denial of service.","status":"published","published":"2022-08-27T00:00:43Z","modified":"2023-02-13T00:31:18Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:54:05.462623Z"}],"nvd":[{"id":"CVE-2022-0216","description":"A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of QEMU. The flaw occurs while processing repeated messages to cancel the current SCSI request via the lsi_do_msgout function. This flaw allows a malicious privileged user within the guest to crash the QEMU process on the host, resulting in a denial of service.","status":"published","published":"2022-08-26T18:15:08.777Z","modified":"2026-06-17T04:20:10.187Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:07:25.883929Z"}],"osv":[{"id":"DEBIAN-CVE-2022-0216","description":"A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of QEMU. The flaw occurs while processing repeated messages to cancel the current SCSI request via the lsi_do_msgout function. This flaw allows a malicious privileged user within the guest to crash the QEMU process on the host, resulting in a denial of service.","status":"published","published":"2022-08-26T18:15:08.777Z","modified":"2026-11-03T08:00:51.302041459Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T08:25:01.007408Z"},{"id":"OESA-2022-1907","title":"qemu security update","description":"QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\n\n\t\tQEMU has two operating modes:\n\n\t\tFull system emulation. In this mode, QEMU emulates a full system (for example a PC),\n\t\tincluding one or several processors and various peripherals. It can be used to launch\n\t\tdifferent Operating Systems without rebooting the PC or to debug system code.\n\n\t\tUser mode emulation. In this mode, QEMU can launch processes compiled for one CPU on another CPU.\n\t\tIt can be used to launch the Wine Windows API emulator (https://www.winehq.org) or to ease\n\t\tcross-compilation and cross-debugging.\n\t\tYou can refer to https://www.qemu.org for more infortmation.\r\n\r\nSecurity Fix(es):\r\n\r\nA use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of QEMU. The flaw occurs while processing repeated messages to cancel the current SCSI request via the lsi_do_msgout function. This flaw allows a malicious privileged user within the guest to crash the QEMU process on the host, resulting in a denial of service.(CVE-2022-0216)","status":"published","published":"2022-09-09T11:05:12Z","modified":"2026-08-18T01:17:18.610719948Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"UBUNTU-CVE-2022-0216","description":"A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of QEMU. The flaw occurs while processing repeated messages to cancel the current SCSI request via the lsi_do_msgout function. This flaw allows a malicious privileged user within the guest to crash the QEMU process on the host, resulting in a denial of service.","status":"published","published":"2022-08-26T18:15:00Z","modified":"2026-02-04T03:01:02.356384Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T16:53:51.630172Z"},{"id":"CVE-2022-0216","description":"A use-after-free vulnerability was found in the LSI53C895A SCSI Host Bus Adapter emulation of QEMU. The flaw occurs while processing repeated messages to cancel the current SCSI request via the lsi_do_msgout function. This flaw allows a malicious privileged user within the guest to crash the QEMU process on the host, resulting in a denial of service.","status":"published","published":"2022-08-26T00:00:00Z","modified":"2026-10-28T02:30:31.987669155Z","cwes":["CWE-416"],"updated_at":"2026-11-02T15:44:22.824781Z"},{"id":"DLA-3362-1","title":"qemu - security update","status":"published","published":"2023-03-14T00:00:00Z","modified":"2026-03-09T01:23:24.053929Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"openSUSE-SU-2024:12209-1","title":"qemu-7.0.0-53.1 on GA media","description":"These are all security issues fixed in the qemu-7.0.0-53.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:30:29.043241Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"SUSE-SU-2022:3594-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- CVE-2021-3409: Fixed an incomplete fix for CVE-2020-17380 and CVE-2020-25085 in sdhi controller. (bsc#1182282)\n- CVE-2021-4206: Fixed an integer overflow in cursor_alloc which can lead to heap buffer overflow. (bsc#1198035)\n- CVE-2021-4207: Fixed a double fetch in qxl_cursor ehich can lead to heap buffer overflow. (bsc#1198037)\n- CVE-2022-0216: Fixed a use after free issue found in hw/scsi/lsi53c895a.c. (bsc#1198038)\n- CVE-2022-35414: Fixed an uninitialized read during address translation that leads to a crash. (bsc#1201367)\n","status":"published","published":"2022-10-17T06:40:58Z","modified":"2026-02-04T02:15:57.803404Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:3660-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- CVE-2022-0216: Fixed a use after free issue found in hw/scsi/lsi53c895a.c. (bsc#1198038)\n- CVE-2022-35414: Fixed an uninitialized read during address translation that leads to a crash. (bsc#1201367) \n","status":"published","published":"2022-10-19T12:00:05Z","modified":"2026-02-04T04:11:47.348491Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:3768-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- CVE-2021-3409: Fixed an incomplete fix for CVE-2020-17380 and CVE-2020-25085 in sdhi controller. (bsc#1182282)\n- CVE-2021-4206: Fixed an integer overflow in cursor_alloc which can lead to heap buffer overflow. (bsc#1198035)\n- CVE-2021-4207: Fixed a double fetch in qxl_cursor ehich can lead to heap buffer overflow. (bsc#1198037)\n- CVE-2022-0216: Fixed a use after free issue found in hw/scsi/lsi53c895a.c. (bsc#1198038)\n- CVE-2022-35414: Fixed an uninitialized read during address translation that leads to a crash. (bsc#1201367)\n- CVE-2021-3507: Fixed a heap buffer overflow in DMA read data transfers. (bsc#1185000)\n- CVE-2020-17380: Fixed a heap buffer overflow in sdhci_sdma_transfer_multi_blocks. (bsc#1175144)\n","status":"published","published":"2022-10-26T10:13:09Z","modified":"2025-05-02T04:30:33.657236Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2022:3795-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- CVE-2022-0216: Fixed a use after free issue found in hw/scsi/lsi53c895a.c. (bsc#1198038)\n- CVE-2022-35414: Fixed an uninitialized read during address translation that leads to a crash. (bsc#1201367)\n","status":"published","published":"2022-10-27T10:46:02Z","modified":"2026-02-04T03:47:13.675896Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"SUSE-SU-2023:0761-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- bsc#1172033 (CVE-2020-13253)\n\n- bsc#1180207 (CVE-2020-14394)\n\n- bsc#1172382 (CVE-2020-13754)\n\n- bsc#1198038 (CVE-2022-0216)\n\n- bsc#1193880 (CVE-2021-3929)\n\n- bsc#1197653 (CVE-2022-1050)\n\n- bsc#1205808 (CVE-2022-4144), bsc#1198712 (CVE-2022-26354)\n  \n- bsc#1175144 (CVE-2020-17380, CVE-2020-25085, CVE-2021-3409),\n  bsc#1185000 (CVE-2021-3507), bsc#1201367, CVE-2022-35414\n- About bsc#1175144, see also bsc#1182282 (CVE-2021-3409)\n  \n- bsc#1198035, CVE-2021-4206\n","status":"published","published":"2023-03-16T10:35:54Z","modified":"2026-02-04T04:04:51.058114Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:0840-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n  \n- CVE-2022-4144: Fixed unsafe address translation can lead to out-of-bounds read in qxl_phys2virt (bsc#1205808).\n- CVE-2021-3507: Fixed heap buffer overflow in DMA read data transfers in fdc (bsc#1185000).\n- CVE-2020-14394: Fixed infinite loop in xhci_ring_chain_length() (bsc#1180207).\n- CVE-2022-0216: Fixed a use-after-free in lsi_do_msgout function in hw/scsi/lsi53c895a.c (bsc#1198038).\n- CVE-2022-1050: Fixed a use-after-free issue in pvrdma_exec_cmd() in pvrdma (bsc#1197653).\n- CVE-2021-3929: Fixed a DMA reentrancy issue leads to use-after-free in nvme (bsc#1193880).\n\nThe following non-security bugs were fixed:\n\n- Fix bsc#1202364.\n","status":"published","published":"2023-03-21T08:54:28Z","modified":"2026-02-04T04:37:43.316997Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:2358-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- CVE-2022-0216: Fixed a use-after-free in lsi_do_msgout() in hw/scsi/lsi53c895a.c (bsc#1198038).\n- CVE-2021-3929: Fixed use-after-free in nvme, caused by DMA reentrancy issue (bsc#1193880).\n- CVE-2021-4207: Fixed heap buffer overflow caused by double fetch in qxl_cursor() (bsc#1198037).\n- CVE-2021-4206: Fixed integer overflow in cursor_alloc() (bsc#1198035).\n- Amend .changes file: avoid declaring a still unfixed CVE, as fixed (bsc#1187529) \n- Fix the build breaks caused by binutils update (bsc#1192463, bsc#1193621)\n","status":"published","published":"2023-06-02T11:36:51Z","modified":"2026-02-04T02:21:21.735197Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"SUSE-SU-2024:1395-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n - CVE-2021-3750: Fixed DMA reentrancy issue that could lead to use-after-free (bsc#1190011)\n - CVE-2022-0216: Fixed use-after-free in lsi_do_msgout function in hw/scsi/lsi53c895a.c (bsc#1198038)\n - CVE-2023-0330: Fixed DMA reentrancy issue that could lead to stack overflow (bsc#1207205)\n - CVE-2023-3180: Fixed heap buffer overflow in virtio_crypto_sym_op_helper() (bsc#1213925)\n - CVE-2023-3354: Fixed improper I/O watch removal in VNC TLS handshake that could lead to remote unauthenticated denial of service (bsc#1212850)\n","status":"published","published":"2024-04-23T09:16:33Z","modified":"2026-02-04T03:12:26.169747Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"USN-5772-1","title":"qemu vulnerabilities","description":"It was discovered that QEMU incorrectly handled bulk transfers from SPICE\nclients. A remote attacker could use this issue to cause QEMU to crash,\nresulting in a denial of service, or possibly execute arbitrary code. This\nissue only affected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM. (CVE-2021-3682)\n\nIt was discovered that QEMU did not properly manage memory when it\ntransfers the USB packets. A malicious guest attacker could use this issue\nto cause QEMU to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. This issue only affected Ubuntu 18.04 LTS, Ubuntu\n20.04 LTS and Ubuntu 22.04 LTS. (CVE-2021-3750)\n\nIt was discovered that the QEMU SCSI device emulation incorrectly handled\ncertain MODE SELECT commands. An attacker inside the guest could possibly\nuse this issue to cause QEMU to crash, resulting in a denial of service.\nThis issue only affected Ubuntu 14.04 ESM and Ubuntu 16.04 ESM.\n(CVE-2021-3930)\n\nIt was discovered that QEMU did not properly manage memory when it\nprocessing repeated messages to cancel the current SCSI request. A\nmalicious privileged guest attacker could use this issue to cause QEMU to\ncrash, resulting in a denial of service. (CVE-2022-0216)\n\nIt was discovered that QEMU did not properly manage memory when it\nusing Tulip device emulation. A malicious guest attacker could use this\nissue to cause QEMU to crash, resulting in a denial of service. This issue\nonly affected Ubuntu 22.10. (CVE-2022-2962)\n\nIt was discovered that QEMU did not properly manage memory when processing\nClientCutText messages. A attacker could use this issue to cause QEMU to\ncrash, resulting in a denial of service. This issue only affected Ubuntu\n22.04 LTS and Ubuntu 22.10. (CVE-2022-3165)\n","status":"published","published":"2022-12-12T06:51:06Z","modified":"2026-06-29T13:50:44.311706141Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}