{"id":"CVE-2022-1050","aliases":["AZL-9277","DEBIAN-CVE-2022-1050","DLA-3362-1","EUVD-2022-24397","GHSA-hgm4-v6hc-gqq9","OESA-2023-1298","OESA-2023-1474","SUSE-SU-2023:0671-1","SUSE-SU-2023:0761-1","SUSE-SU-2023:0840-1","SUSE-SU-2023:3721-1","SUSE-SU-2023:3800-1","UBUNTU-CVE-2022-1050","USN-6167-1","openSUSE-SU-2024:12736-1"],"status":"published","title":"Guest driver might execute HW commands when shared buffers are not yet allocated, potentially...","description":"A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to execute HW commands when shared buffers are not yet allocated, potentially leading to a use-after-free condition.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0038,"percentile":0.32304,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-416"],"published":"2022-03-29T00:00:00Z","modified":"2026-11-03T08:02:07Z","fixes":[{"ecosystem":"Azure Linux:2","package":"qemu","fixed_in":["6.2.0-2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"qemu","fixed_in":["1:7.1+dfsg-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"qemu","fixed_in":["1:7.1+dfsg-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"qemu","fixed_in":["1:7.1+dfsg-2"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"qemu","fixed_in":["4.1.0-73.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"qemu","fixed_in":["4.1.0-77.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"qemu","fixed_in":["6.2.0-74.oe2203sp1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"qemu","fixed_in":["1:4.2-3ubuntu6.27"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"qemu","fixed_in":["1:6.2+dfsg-2ubuntu6.11"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"qemu","fixed_in":["7.1.0-12.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.1+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.1+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.1+dfsg-2"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.1+dfsg-8+deb10u10"}]}],"versions":["1:3.1+dfsg-8","1:3.1+dfsg-8+deb10u2","1:3.1+dfsg-8+deb10u3","1:3.1+dfsg-8+deb10u4","1:3.1+dfsg-8+deb10u5","1:3.1+dfsg-8+deb10u6","1:3.1+dfsg-8+deb10u7","1:3.1+dfsg-8+deb10u8","1:3.1+dfsg-8+deb10u9","1:3.1+dfsg-8~deb10u1"],"bundled":10},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.0-73.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.0-77.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-74.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-72.oe2203"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP4","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP4","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap Micro 5.3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"qemu-linux-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.11.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"qemu-testsuite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2.0-150400.37.11.2"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1.1-66.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1.1-66.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-ESPOS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.121.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.121.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.121.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.121.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.121.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.121.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Manager Server 4.2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.121.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.121.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.121.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.0-150300.121.2"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-150200.79.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-150200.79.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-150200.79.1"}]}],"bundled":10},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-150200.79.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1.1-150100.80.51.5"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1.1-150100.80.51.5"}]}],"bundled":9},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.1.1.1-150100.80.51.5"}]}],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2-3ubuntu6.27"}]}],"versions":["1:4.0+dfsg-0ubuntu9","1:4.0+dfsg-0ubuntu10","1:4.2-1ubuntu1","1:4.2-1ubuntu2","1:4.2-3ubuntu1","1:4.2-3ubuntu2","1:4.2-3ubuntu3","1:4.2-3ubuntu4","1:4.2-3ubuntu5","1:4.2-3ubuntu6","1:4.2-3ubuntu6.1","1:4.2-3ubuntu6.2","1:4.2-3ubuntu6.3","1:4.2-3ubuntu6.4","1:4.2-3ubuntu6.5","1:4.2-3ubuntu6.6","1:4.2-3ubuntu6.7","1:4.2-3ubuntu6.8","1:4.2-3ubuntu6.9","1:4.2-3ubuntu6.10","1:4.2-3ubuntu6.11","1:4.2-3ubuntu6.12","1:4.2-3ubuntu6.14","1:4.2-3ubuntu6.15","1:4.2-3ubuntu6.16","1:4.2-3ubuntu6.17","1:4.2-3ubuntu6.18","1:4.2-3ubuntu6.19","1:4.2-3ubuntu6.21","1:4.2-3ubuntu6.23","1:4.2-3ubuntu6.24","1:4.2-3ubuntu6.25","1:4.2-3ubuntu6.26"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.2+dfsg-2ubuntu6.11"}]}],"versions":["1:6.0+dfsg-2expubuntu1","1:6.0+dfsg-2expubuntu2","1:6.0+dfsg-2expubuntu4","1:6.2+dfsg-2ubuntu5","1:6.2+dfsg-2ubuntu6","1:6.2+dfsg-2ubuntu6.1","1:6.2+dfsg-2ubuntu6.2","1:6.2+dfsg-2ubuntu6.3","1:6.2+dfsg-2ubuntu6.4","1:6.2+dfsg-2ubuntu6.5","1:6.2+dfsg-2ubuntu6.6","1:6.2+dfsg-2ubuntu6.7","1:6.2+dfsg-2ubuntu6.8","1:6.2+dfsg-2ubuntu6.9","1:6.2+dfsg-2ubuntu6.10"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.0+dfsg-2ubuntu1.47+esm3"}]}],"versions":["1.5.0+dfsg-3ubuntu5","1.5.0+dfsg-3ubuntu6","1.6.0+dfsg-2ubuntu1","1.6.0+dfsg-2ubuntu2","1.6.0+dfsg-2ubuntu3","1.6.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu1","1.7.0+dfsg-2ubuntu2","1.7.0+dfsg-2ubuntu3","1.7.0+dfsg-2ubuntu4","1.7.0+dfsg-2ubuntu5","1.7.0+dfsg-2ubuntu7","1.7.0+dfsg-2ubuntu8","1.7.0+dfsg-2ubuntu9","1.7.0+dfsg-3ubuntu1~ppa1","1.7.0+dfsg-3ubuntu1","1.7.0+dfsg-3ubuntu2","1.7.0+dfsg-3ubuntu3","1.7.0+dfsg-3ubuntu4","1.7.0+dfsg-3ubuntu5","1.7.0+dfsg-3ubuntu6","1.7.0+dfsg-3ubuntu7","2.0.0~rc1+dfsg-0ubuntu1","2.0.0~rc1+dfsg-0ubuntu2","2.0.0~rc1+dfsg-0ubuntu3","2.0.0~rc1+dfsg-0ubuntu3.1","2.0.0+dfsg-2ubuntu1","2.0.0+dfsg-2ubuntu1.1","2.0.0+dfsg-2ubuntu1.2","2.0.0+dfsg-2ubuntu1.3","2.0.0+dfsg-2ubuntu1.5","2.0.0+dfsg-2ubuntu1.6","2.0.0+dfsg-2ubuntu1.7","2.0.0+dfsg-2ubuntu1.8","2.0.0+dfsg-2ubuntu1.9","2.0.0+dfsg-2ubuntu1.10","2.0.0+dfsg-2ubuntu1.11","2.0.0+dfsg-2ubuntu1.13","2.0.0+dfsg-2ubuntu1.14","2.0.0+dfsg-2ubuntu1.15","2.0.0+dfsg-2ubuntu1.16","2.0.0+dfsg-2ubuntu1.17","2.0.0+dfsg-2ubuntu1.18","2.0.0+dfsg-2ubuntu1.19","2.0.0+dfsg-2ubuntu1.20","2.0.0+dfsg-2ubuntu1.21","2.0.0+dfsg-2ubuntu1.22","2.0.0+dfsg-2ubuntu1.24","2.0.0+dfsg-2ubuntu1.25","2.0.0+dfsg-2ubuntu1.26","2.0.0+dfsg-2ubuntu1.27","2.0.0+dfsg-2ubuntu1.28","2.0.0+dfsg-2ubuntu1.29","2.0.0+dfsg-2ubuntu1.30","2.0.0+dfsg-2ubuntu1.31","2.0.0+dfsg-2ubuntu1.32","2.0.0+dfsg-2ubuntu1.33","2.0.0+dfsg-2ubuntu1.34","2.0.0+dfsg-2ubuntu1.35","2.0.0+dfsg-2ubuntu1.36","2.0.0+dfsg-2ubuntu1.38","2.0.0+dfsg-2ubuntu1.39","2.0.0+dfsg-2ubuntu1.40","2.0.0+dfsg-2ubuntu1.41","2.0.0+dfsg-2ubuntu1.42","2.0.0+dfsg-2ubuntu1.43","2.0.0+dfsg-2ubuntu1.44","2.0.0+dfsg-2ubuntu1.45","2.0.0+dfsg-2ubuntu1.46","2.0.0+dfsg-2ubuntu1.47","2.0.0+dfsg-2ubuntu1.47+esm1","2.0.0+dfsg-2ubuntu1.47+esm2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.5+dfsg-5ubuntu10.51+esm2"}]}],"versions":["1:2.3+dfsg-5ubuntu9","1:2.3+dfsg-5ubuntu10","1:2.4+dfsg-4ubuntu1","1:2.4+dfsg-4ubuntu2","1:2.4+dfsg-4ubuntu3","1:2.4+dfsg-5ubuntu3","1:2.5+dfsg-1ubuntu2","1:2.5+dfsg-1ubuntu3","1:2.5+dfsg-1ubuntu4","1:2.5+dfsg-1ubuntu5","1:2.5+dfsg-5ubuntu1","1:2.5+dfsg-5ubuntu2","1:2.5+dfsg-5ubuntu4","1:2.5+dfsg-5ubuntu6","1:2.5+dfsg-5ubuntu7","1:2.5+dfsg-5ubuntu10","1:2.5+dfsg-5ubuntu10.1","1:2.5+dfsg-5ubuntu10.2","1:2.5+dfsg-5ubuntu10.3","1:2.5+dfsg-5ubuntu10.4","1:2.5+dfsg-5ubuntu10.5","1:2.5+dfsg-5ubuntu10.6","1:2.5+dfsg-5ubuntu10.7","1:2.5+dfsg-5ubuntu10.8","1:2.5+dfsg-5ubuntu10.9","1:2.5+dfsg-5ubuntu10.10","1:2.5+dfsg-5ubuntu10.11","1:2.5+dfsg-5ubuntu10.13","1:2.5+dfsg-5ubuntu10.14","1:2.5+dfsg-5ubuntu10.15","1:2.5+dfsg-5ubuntu10.16","1:2.5+dfsg-5ubuntu10.20","1:2.5+dfsg-5ubuntu10.21","1:2.5+dfsg-5ubuntu10.22","1:2.5+dfsg-5ubuntu10.24","1:2.5+dfsg-5ubuntu10.25","1:2.5+dfsg-5ubuntu10.26","1:2.5+dfsg-5ubuntu10.28","1:2.5+dfsg-5ubuntu10.29","1:2.5+dfsg-5ubuntu10.30","1:2.5+dfsg-5ubuntu10.31","1:2.5+dfsg-5ubuntu10.32","1:2.5+dfsg-5ubuntu10.33","1:2.5+dfsg-5ubuntu10.34","1:2.5+dfsg-5ubuntu10.35","1:2.5+dfsg-5ubuntu10.36","1:2.5+dfsg-5ubuntu10.37","1:2.5+dfsg-5ubuntu10.38","1:2.5+dfsg-5ubuntu10.39","1:2.5+dfsg-5ubuntu10.40","1:2.5+dfsg-5ubuntu10.41","1:2.5+dfsg-5ubuntu10.42","1:2.5+dfsg-5ubuntu10.43","1:2.5+dfsg-5ubuntu10.44","1:2.5+dfsg-5ubuntu10.45","1:2.5+dfsg-5ubuntu10.46","1:2.5+dfsg-5ubuntu10.47","1:2.5+dfsg-5ubuntu10.48","1:2.5+dfsg-5ubuntu10.49","1:2.5+dfsg-5ubuntu10.51","1:2.5+dfsg-5ubuntu10.51+esm1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.11+dfsg-1ubuntu7.42+esm1"}]}],"versions":["1:2.10+dfsg-0ubuntu3","1:2.10+dfsg-0ubuntu4","1:2.10+dfsg-0ubuntu5","1:2.11+dfsg-1ubuntu1","1:2.11+dfsg-1ubuntu2","1:2.11+dfsg-1ubuntu4","1:2.11+dfsg-1ubuntu5","1:2.11+dfsg-1ubuntu6","1:2.11+dfsg-1ubuntu7","1:2.11+dfsg-1ubuntu7.1","1:2.11+dfsg-1ubuntu7.2","1:2.11+dfsg-1ubuntu7.3","1:2.11+dfsg-1ubuntu7.4","1:2.11+dfsg-1ubuntu7.5","1:2.11+dfsg-1ubuntu7.6","1:2.11+dfsg-1ubuntu7.7","1:2.11+dfsg-1ubuntu7.8","1:2.11+dfsg-1ubuntu7.9","1:2.11+dfsg-1ubuntu7.10","1:2.11+dfsg-1ubuntu7.12","1:2.11+dfsg-1ubuntu7.13","1:2.11+dfsg-1ubuntu7.14","1:2.11+dfsg-1ubuntu7.15","1:2.11+dfsg-1ubuntu7.17","1:2.11+dfsg-1ubuntu7.18","1:2.11+dfsg-1ubuntu7.19","1:2.11+dfsg-1ubuntu7.20","1:2.11+dfsg-1ubuntu7.21","1:2.11+dfsg-1ubuntu7.22","1:2.11+dfsg-1ubuntu7.23","1:2.11+dfsg-1ubuntu7.25","1:2.11+dfsg-1ubuntu7.26","1:2.11+dfsg-1ubuntu7.27","1:2.11+dfsg-1ubuntu7.28","1:2.11+dfsg-1ubuntu7.29","1:2.11+dfsg-1ubuntu7.31","1:2.11+dfsg-1ubuntu7.32","1:2.11+dfsg-1ubuntu7.33","1:2.11+dfsg-1ubuntu7.34","1:2.11+dfsg-1ubuntu7.35","1:2.11+dfsg-1ubuntu7.36","1:2.11+dfsg-1ubuntu7.37","1:2.11+dfsg-1ubuntu7.38","1:2.11+dfsg-1ubuntu7.39","1:2.11+dfsg-1ubuntu7.40","1:2.11+dfsg-1ubuntu7.41","1:2.11+dfsg-1ubuntu7.42"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.2-3ubuntu6.27"}]}],"versions":["1:4.0+dfsg-0ubuntu9","1:4.0+dfsg-0ubuntu10","1:4.2-1ubuntu1","1:4.2-1ubuntu2","1:4.2-3ubuntu1","1:4.2-3ubuntu2","1:4.2-3ubuntu3","1:4.2-3ubuntu4","1:4.2-3ubuntu5","1:4.2-3ubuntu6","1:4.2-3ubuntu6.1","1:4.2-3ubuntu6.2","1:4.2-3ubuntu6.3","1:4.2-3ubuntu6.4","1:4.2-3ubuntu6.5","1:4.2-3ubuntu6.6","1:4.2-3ubuntu6.7","1:4.2-3ubuntu6.8","1:4.2-3ubuntu6.9","1:4.2-3ubuntu6.10","1:4.2-3ubuntu6.11","1:4.2-3ubuntu6.12","1:4.2-3ubuntu6.14","1:4.2-3ubuntu6.15","1:4.2-3ubuntu6.16","1:4.2-3ubuntu6.17","1:4.2-3ubuntu6.18","1:4.2-3ubuntu6.19","1:4.2-3ubuntu6.21","1:4.2-3ubuntu6.23","1:4.2-3ubuntu6.24","1:4.2-3ubuntu6.25","1:4.2-3ubuntu6.26"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:6.2+dfsg-2ubuntu6.11"}]}],"versions":["1:6.0+dfsg-2expubuntu1","1:6.0+dfsg-2expubuntu2","1:6.0+dfsg-2expubuntu4","1:6.2+dfsg-2ubuntu5","1:6.2+dfsg-2ubuntu6","1:6.2+dfsg-2ubuntu6.1","1:6.2+dfsg-2ubuntu6.2","1:6.2+dfsg-2ubuntu6.3","1:6.2+dfsg-2ubuntu6.4","1:6.2+dfsg-2ubuntu6.5","1:6.2+dfsg-2ubuntu6.6","1:6.2+dfsg-2ubuntu6.7","1:6.2+dfsg-2ubuntu6.8","1:6.2+dfsg-2ubuntu6.9","1:6.2+dfsg-2ubuntu6.10"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-12.1"}]}]}],"products":[{"vendor":"qemu","product":"qemu"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2069625","tags":["x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/03/msg00013.html","tags":["mailing-list","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1050","tags":["web","advisory"]},{"url":"https://lists.nongnu.org/archive/html/qemu-devel/2022-03/msg05197.html","tags":["report"]},{"url":"https://github.com/advisories/GHSA-hgm4-v6hc-gqq9"},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-1050","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1298","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1474","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-0664","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-2861","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230671-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1197653","tags":["report"]},{"url":"https://bugzilla.suse.com/1202364","tags":["report"]},{"url":"https://bugzilla.suse.com/1203788","tags":["report"]},{"url":"https://bugzilla.suse.com/1205808","tags":["report"]},{"url":"https://bugzilla.suse.com/1206527","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-1050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-3165","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-4144","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230761-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1172033","tags":["report"]},{"url":"https://bugzilla.suse.com/1172382","tags":["report"]},{"url":"https://bugzilla.suse.com/1175144","tags":["report"]},{"url":"https://bugzilla.suse.com/1180207","tags":["report"]},{"url":"https://bugzilla.suse.com/1182282","tags":["report"]},{"url":"https://bugzilla.suse.com/1185000","tags":["report"]},{"url":"https://bugzilla.suse.com/1193880","tags":["report"]},{"url":"https://bugzilla.suse.com/1198035","tags":["report"]},{"url":"https://bugzilla.suse.com/1198038","tags":["report"]},{"url":"https://bugzilla.suse.com/1198712","tags":["report"]},{"url":"https://bugzilla.suse.com/1201367","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13253","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-13754","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14394","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-17380","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25085","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3409","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3507","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3929","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-4206","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0216","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-26354","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-35414","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20230840-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233721-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1188609","tags":["report"]},{"url":"https://bugzilla.suse.com/1190011","tags":["report"]},{"url":"https://bugzilla.suse.com/1207205","tags":["report"]},{"url":"https://bugzilla.suse.com/1212850","tags":["report"]},{"url":"https://bugzilla.suse.com/1212968","tags":["report"]},{"url":"https://bugzilla.suse.com/1213925","tags":["report"]},{"url":"https://bugzilla.suse.com/1215311","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3638","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3750","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-0330","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-2861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-3180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-3354","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20233800-1/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-13754","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-1050","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-6167-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-1050","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-4144","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-4172","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2023-0330","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-1050","description":"A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to execute HW commands when shared buffers are not yet allocated, potentially leading to a use-after-free condition.","status":"published","published":"2022-03-29T00:00:00Z","modified":"2024-08-02T23:47:43.236Z","cwes":["CWE-416"],"updated_at":"2026-11-02T14:34:38.922686Z"}],"euvd":[{"id":"EUVD-2022-24397","description":"A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to execute HW commands when shared buffers are not yet allocated, potentially leading to a use-after-free condition.","status":"published","published":"2022-03-29T00:00:00Z","modified":"2024-08-02T23:47:43Z","updated_at":"2026-11-03T03:26:03.022972Z"}],"ghsa":[{"id":"GHSA-hgm4-v6hc-gqq9","title":"Guest driver might execute HW commands when shared buffers are not yet allocated, potentially...","description":"Guest driver might execute HW commands when shared buffers are not yet allocated, potentially leading to a use-after-free condition.","status":"published","published":"2022-03-30T00:00:21Z","modified":"2023-03-22T05:03:10Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:54:22.471958Z"}],"nvd":[{"id":"CVE-2022-1050","description":"A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to execute HW commands when shared buffers are not yet allocated, potentially leading to a use-after-free condition.","status":"published","published":"2022-03-29T17:15:15.11Z","modified":"2026-06-17T04:21:44.033Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:L/AC:L/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-416"],"updated_at":"2026-11-02T14:07:14.706146Z"}],"osv":[{"id":"AZL-9277","title":"CVE-2022-1050 affecting package qemu for versions less than 6.2.0-2","description":"A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to execute HW commands when shared buffers are not yet allocated, potentially leading to a use-after-free condition.","status":"published","published":"2022-03-29T17:15:15Z","modified":"2026-04-21T04:35:00.157317Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:11.723718Z"},{"id":"CVE-2022-1050","description":"A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to execute HW commands when shared buffers are not yet allocated, potentially leading to a use-after-free condition.","status":"published","published":"2022-03-29T17:15:15.11Z","modified":"2026-03-14T11:22:13.189742Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:23.245966Z"},{"id":"DEBIAN-CVE-2022-1050","description":"A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to execute HW commands when shared buffers are not yet allocated, potentially leading to a use-after-free condition.","status":"published","published":"2022-03-29T17:15:15.11Z","modified":"2026-11-03T08:02:07.544741582Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T08:24:50.542442Z"},{"id":"OESA-2023-1298","title":"qemu security update","description":"\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in the QEMU implementation of VMWare\u0026apos;s paravirtual RDMA device. This flaw allows a crafted guest driver to execute HW commands when shared buffers are not yet allocated, potentially leading to a use-after-free condition.(CVE-2022-1050)","status":"published","published":"2023-05-26T11:05:46Z","modified":"2026-08-18T01:17:40.466543101Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.934788Z"},{"id":"OESA-2023-1474","title":"qemu security update","description":"QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in the QEMU implementation of VMWare\u0026apos;s paravirtual RDMA device. This flaw allows a crafted guest driver to execute HW commands when shared buffers are not yet allocated, potentially leading to a use-after-free condition.(CVE-2022-1050)\r\n\r\nA flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to manipulate the QEMU Guest Agent\u0026apos;s Windows installer via repair custom actions to elevate their privileges on the system.(CVE-2023-0664)\r\n\r\nA flaw was found in the 9p passthrough filesystem (9pfs) implementation in QEMU. The 9pfs server did not prohibit opening special files on the host side, potentially allowing a malicious client to escape from the exported 9p tree by creating and opening a device file in the shared folder.(CVE-2023-2861)","status":"published","published":"2023-08-06T11:05:56Z","modified":"2026-08-18T01:17:45.973061485Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"UBUNTU-CVE-2022-1050","description":"A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to execute HW commands when shared buffers are not yet allocated, potentially leading to a use-after-free condition.","status":"published","published":"2022-03-29T17:15:00Z","modified":"2026-02-04T02:47:22.772923Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:51.630172Z"},{"id":"DLA-3362-1","title":"qemu - security update","status":"published","published":"2023-03-14T00:00:00Z","modified":"2026-03-09T01:23:24.053929Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"openSUSE-SU-2024:12736-1","title":"qemu-7.1.0-12.1 on GA media","description":"These are all security issues fixed in the qemu-7.1.0-12.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:20:50.392449Z","updated_at":"2026-11-02T16:58:35.751245Z"},{"id":"SUSE-SU-2023:0671-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n  - CVE-2022-4144: Fixed qxl_phys2virt unsafe address translation that can lead to out-of-bounds read (bsc#1205808).\n  - CVE-2022-3165: Fixed integer underflow in vnc_client_cut_text_ext() (bsc#1203788).\n  - CVE-2022-1050: Fixed use-after-free issue in pvrdma_exec_cmd() (bsc#1197653).\n\n  Bugfixes:\n\n  - Fixed deviation of guest clock (bsc#1206527).\n  - Fixed broken 'block limits' VPD emulation (bsc#1202364).\n\n","status":"published","published":"2023-03-08T10:55:39Z","modified":"2026-02-04T03:16:15.047318Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:0761-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- bsc#1172033 (CVE-2020-13253)\n\n- bsc#1180207 (CVE-2020-14394)\n\n- bsc#1172382 (CVE-2020-13754)\n\n- bsc#1198038 (CVE-2022-0216)\n\n- bsc#1193880 (CVE-2021-3929)\n\n- bsc#1197653 (CVE-2022-1050)\n\n- bsc#1205808 (CVE-2022-4144), bsc#1198712 (CVE-2022-26354)\n  \n- bsc#1175144 (CVE-2020-17380, CVE-2020-25085, CVE-2021-3409),\n  bsc#1185000 (CVE-2021-3507), bsc#1201367, CVE-2022-35414\n- About bsc#1175144, see also bsc#1182282 (CVE-2021-3409)\n  \n- bsc#1198035, CVE-2021-4206\n","status":"published","published":"2023-03-16T10:35:54Z","modified":"2026-02-04T04:04:51.058114Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:0840-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n  \n- CVE-2022-4144: Fixed unsafe address translation can lead to out-of-bounds read in qxl_phys2virt (bsc#1205808).\n- CVE-2021-3507: Fixed heap buffer overflow in DMA read data transfers in fdc (bsc#1185000).\n- CVE-2020-14394: Fixed infinite loop in xhci_ring_chain_length() (bsc#1180207).\n- CVE-2022-0216: Fixed a use-after-free in lsi_do_msgout function in hw/scsi/lsi53c895a.c (bsc#1198038).\n- CVE-2022-1050: Fixed a use-after-free issue in pvrdma_exec_cmd() in pvrdma (bsc#1197653).\n- CVE-2021-3929: Fixed a DMA reentrancy issue leads to use-after-free in nvme (bsc#1193880).\n\nThe following non-security bugs were fixed:\n\n- Fix bsc#1202364.\n","status":"published","published":"2023-03-21T08:54:28Z","modified":"2026-02-04T04:37:43.316997Z","updated_at":"2026-11-02T15:53:52.350754Z"},{"id":"SUSE-SU-2023:3721-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- CVE-2022-26354: Fixed a memory leak due to a missing virtqueue detach on error. (bsc#1198712)\n- CVE-2021-3929: Fixed an use-after-free in nvme DMA reentrancy issue. (bsc#1193880)\n- CVE-2023-0330: Fixed a stack overflow due to a DMA reentrancy issue. (bsc#1207205)\n- CVE-2020-13754: Fixed a DoS due to an OOB access during mmio operations. (bsc#1172382)\n- CVE-2023-3354: Fixed a remote unauthenticated DoS due to an improper I/O watch removal in VNC TLS handshake. (bsc#1212850)\n- CVE-2023-3180: Fixed a heap buffer overflow in virtio_crypto_sym_op_helper(). (bsc#1213925)\n- CVE-2021-3638: Fixed an out-of-bounds write due to an inconsistent check in ati_2d_blt(). (bsc#1188609)\n- CVE-2021-3750: Fixed an use-after-free in DMA reentrancy issue. (bsc#1190011)\n- CVE-2023-2861: Fixed improper access control on special files in 9pfs (bsc#1212968).\n- CVE-2022-1050: Fixed use-after-free issue in pvrdma_exec_cmd() (bsc#1197653).\n\nThe following non-security bug was fixed:\n\n- Prepare for binutils update to 2.41 update (bsc#1215311).\n","status":"published","published":"2023-09-21T07:57:13Z","modified":"2026-02-04T04:33:33.102505Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"SUSE-SU-2023:3800-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- CVE-2022-26354: Fixed a memory leak due to a missing virtqueue detach on error. (bsc#1198712)\n- CVE-2021-3929: Fixed an use-after-free in nvme DMA reentrancy issue. (bsc#1193880)\n- CVE-2023-0330: Fixed a stack overflow due to a DMA reentrancy issue. (bsc#1207205)\n- CVE-2020-13754: Fixed a DoS due to an OOB access during mmio operations. (bsc#1172382)\n- CVE-2023-3354: Fixed a remote unauthenticated DoS due to an improper I/O watch removal in VNC TLS handshake. (bsc#1212850)\n- CVE-2023-3180: Fixed a heap buffer overflow in virtio_crypto_sym_op_helper(). (bsc#1213925)\n- CVE-2023-2861: Fixed improper access control on special files in 9pfs (bsc#1212968).\n- CVE-2022-1050: Fixed use-after-free issue in pvrdma_exec_cmd() (bsc#1197653).\n- CVE-2021-3750: Fixed DMA reentrancy issue leads to use-after-free in hcd-ehci (bsc#1190011).\n\nThe following non-security bug was fixed:\n\n- Prepare for binutils update to 2.41 update (bsc#1215311).\n","status":"published","published":"2023-09-27T11:36:03Z","modified":"2026-02-04T03:39:59.892369Z","updated_at":"2026-11-02T15:53:53.440387Z"},{"id":"USN-6167-1","title":"qemu vulnerabilities","description":"It was discovered that QEMU did not properly manage the guest drivers when\nshared buffers are not allocated. A malicious guest driver could use this\nissue to cause QEMU to crash, resulting in a denial of service, or possibly\nexecute arbitrary code. This issue only affected Ubuntu 20.04 LTS, Ubuntu\n22.04 LTS and Ubuntu 22.10. (CVE-2022-1050)\n\nIt was discovered that QEMU did not properly check the size of the\nstructure pointed to by the guest physical address pqxl. A malicious guest\nattacker could use this issue to cause QEMU to crash, resulting in a denial\nof service. This issue only affected Ubuntu 14.04 LTS, Ubuntu 16.04 LTS,\nUbuntu 18.04 LTS, Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu 22.10.\n(CVE-2022-4144)\n\nIt was discovered that QEMU did not properly manage memory in the ACPI\nError Record Serialization Table (ERST) device. A malicious guest attacker\ncould use this issue to cause QEMU to crash, resulting in a denial of\nservice. This issue only affected Ubuntu 22.10. (CVE-2022-4172)\n\nIt was discovered that QEMU did not properly manage memory when DMA memory\nwrites happen repeatedly in the lsi53c895a device. A malicious guest\nattacker could use this issue to cause QEMU to crash, resulting in a denial\nof service. (CVE-2023-0330)\n","status":"published","published":"2023-06-19T02:52:13Z","modified":"2026-06-29T13:50:53.163098226Z","updated_at":"2026-11-02T16:58:16.738762Z"}]}}