{"id":"CVE-2023-42467","aliases":["ALSA-2024:2135","AZL-35172","BELL-CVE-2023-42467","CLSA-2026-1778125769","DEBIAN-CVE-2023-42467","EUVD-2023-46907","GHSA-q76v-8f8c-4c2j","MGASA-2024-0387","RHSA-2024:2135","RLSA-2024:2135","SUSE-SU-2025:0516-1","openSUSE-SU-2024:13364-1"],"status":"published","title":"QEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset in hw/scsi/scsi-disk.c...","description":"QEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset in hw/scsi/scsi-disk.c because scsi_disk_emulate_mode_select does not prevent s-\u003eqdev.blocksize from being 256. This stops QEMU and the guest immediately.","severity":{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00415,"percentile":0.36121,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-369"],"published":"2023-09-11T00:00:00Z","modified":"2026-10-29T11:31:42Z","fixes":[{"ecosystem":"Azure Linux:3","package":"qemu","fixed_in":["8.2.0-1"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"qemu","fixed_in":["9.0.2-r0"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"qemu","fixed_in":["8.2.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"qemu","fixed_in":["1:7.2+dfsg-7+deb12u3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"qemu","fixed_in":["1:8.1.1+ds-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"qemu","fixed_in":["1:8.1.1+ds-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"qemu","fixed_in":["7.1.0-150500.49.30.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"qemu","fixed_in":["8.1.2-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm-audio-pa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm-block-blkio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm-block-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm-block-rbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm-device-display-virtio-gpu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm-device-display-virtio-gpu-ccw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm-device-display-virtio-gpu-pci","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm-device-display-virtio-vga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm-device-usb-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm-device-usb-redirect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm-ui-egl-headless","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-kvm-ui-opengl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"AlmaLinux:9","package":"qemu-pr-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Azure Linux:3","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.2.0-1"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.1.0-r4"},{"fixed":"9.0.2-r0"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.0.2-r0"},{"fixed":"8.2.0-r0"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-kvm-audio-pa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-kvm-block-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-kvm-block-rbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-kvm-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-kvm-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-kvm-device-display-virtio-gpu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-kvm-device-display-virtio-gpu-pci","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-kvm-device-display-virtio-vga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-kvm-device-usb-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-kvm-device-usb-redirect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-kvm-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-kvm-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-kvm-ui-egl-headless","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-kvm-ui-opengl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"qemu-pr-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:7.2.0-14.el9.5.alma.1.tuxcare.els7"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:7.2+dfsg-7+deb12u3"}]}],"versions":["1:7.2+dfsg-7","1:7.2+dfsg-7+deb12u1","1:7.2+dfsg-7+deb12u2","1:7.2+dfsg-7+deb12u2~bpo11+1"]},{"source":"osv","ecosystem":"Debian:13","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.1.1+ds-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:8.1.1+ds-1"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.2.15-1.mga9"}]}],"bundled":16},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-guest-agent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-guest-agent-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-img","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-img-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-audio-dbus-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-audio-pa","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-audio-pa-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-block-blkio","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-block-blkio-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-block-curl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-block-curl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-block-rbd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-block-rbd-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-common-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-core","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-core-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-display-virtio-gpu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-display-virtio-gpu-ccw","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-display-virtio-gpu-ccw-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-display-virtio-gpu-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-display-virtio-gpu-pci","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-display-virtio-gpu-pci-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-display-virtio-vga","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-display-virtio-vga-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-usb-host","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-usb-host-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-usb-redirect","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-device-usb-redirect-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-tests-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-tools-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-ui-dbus-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-ui-egl-headless","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-ui-egl-headless-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-ui-opengl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-kvm-ui-opengl-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-pr-helper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:9::appstream","package":"qemu-pr-helper-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"Rocky Linux:9","package":"qemu-kvm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7:8.2.0-11.el9_4"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.1.0-150500.49.30.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"qemu","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.2-1.1"}]}]}],"products":[{"vendor":"qemu","product":"qemu"}],"references":[{"url":"https://gitlab.com/qemu-project/qemu/-/issues/1813","tags":["x_transferred","Exploit","Issue Tracking","Third Party Advisory","report","article"]},{"url":"https://gitlab.com/qemu-project/qemu/-/commit/7cfcc79b0ab800959716738aff9419f53fc68c9c","tags":["x_transferred","fix"]},{"url":"https://security.netapp.com/advisory/ntap-20231103-0005/","tags":["x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-42467","tags":["web","advisory"]},{"url":"https://gitlab.com/thuth/qemu/-/commit/3f91104484e5bf55b56d7e1b039a4a5a17d0c1a7"},{"url":"https://github.com/advisories/GHSA-q76v-8f8c-4c2j"},{"url":"https://access.redhat.com/errata/RHSA-2024:2135","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-3019","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-3255","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-42467","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-5088","tags":["report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-6683","tags":["report"]},{"url":"https://bugzilla.redhat.com/2218486","tags":["report"]},{"url":"https://bugzilla.redhat.com/2222351","tags":["report"]},{"url":"https://bugzilla.redhat.com/2238291","tags":["report"]},{"url":"https://bugzilla.redhat.com/2247283","tags":["report"]},{"url":"https://bugzilla.redhat.com/2254825","tags":["report"]},{"url":"https://errata.almalinux.org/9/ALSA-2024-2135.html","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2023-42467","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/advisories/BELL-SA-2024-55","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1778125769.html","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/42xxx/CVE-2023-42467.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-42467","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0387.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33074","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/ES5DXAAMYUC767MUW4BPRP6ZPDL6SUW6/","tags":["web"]},{"url":"https://lists.suse.com/pipermail/sle-updates/2024-April/035064.html","tags":["web"]},{"url":"https://lwn.net/Articles/971720/","tags":["web"]},{"url":"https://lists.suse.com/pipermail/sle-updates/2024-August/036644.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/HL7L7OSCUZ44UAQCOB6IUOFBWKV6ECP2/","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.4_release_notes/index","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2218486","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2222351","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2238291","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2247283","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2254825","tags":["report"]},{"url":"https://issues.redhat.com/browse/RHEL-11219","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-12991","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-14111","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-15394","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-15965","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-16581","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-16686","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-1676","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-17067","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-17068","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-1708","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-17168","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-17209","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-17369","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-1761","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-18212","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-19010","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-19117","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-19119","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-19738","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-20764","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-21057","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-21293","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-21570","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-21705","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-24045","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-24593","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-24614","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-24988","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-26049","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-3922","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-3934","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-5324","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-6101","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-7098","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-7115","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-7135","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-7356","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-7360","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-7361","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-7414","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-7478","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-7526","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-7527","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-7561","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-7565","tags":["article"]},{"url":"https://issues.redhat.com/browse/RHEL-832","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2135.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-3019","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-3019","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-3255","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-3255","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-5088","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5088","tags":["advisory"]},{"url":"https://lore.kernel.org/all/20230921160712.99521-1-simon.rowe@nutanix.com/T/","tags":["article"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-6683","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-6683","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-42467","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2024:2135","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20250516-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1215192","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-42467","tags":["web"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-42467","description":"QEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset in hw/scsi/scsi-disk.c because scsi_disk_emulate_mode_select does not prevent s-\u003eqdev.blocksize from being 256. This stops QEMU and the guest immediately.","status":"published","published":"2023-09-11T00:00:00Z","modified":"2024-09-26T17:36:32.735Z","updated_at":"2026-11-02T14:35:18.16233Z"}],"euvd":[{"id":"EUVD-2023-46907","description":"QEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset in hw/scsi/scsi-disk.c because scsi_disk_emulate_mode_select does not prevent s-\u003eqdev.blocksize from being 256. This stops QEMU and the guest immediately.","status":"published","published":"2023-09-11T00:00:00Z","modified":"2024-09-26T17:36:32Z","updated_at":"2026-11-03T00:28:08.503734Z"}],"ghsa":[{"id":"GHSA-q76v-8f8c-4c2j","title":"QEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset in hw/scsi/scsi-disk.c...","description":"QEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset in hw/scsi/scsi-disk.c because scsi_disk_emulate_mode_select does not prevent s-\u003eqdev.blocksize from being 256. This stops QEMU and the guest immediately.","status":"published","published":"2023-09-11T06:30:15Z","modified":"2023-11-13T05:04:28Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-369"],"updated_at":"2026-11-02T14:55:00.129765Z"}],"nvd":[{"id":"CVE-2023-42467","description":"QEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset in hw/scsi/scsi-disk.c because scsi_disk_emulate_mode_select does not prevent s-\u003eqdev.blocksize from being 256. This stops QEMU and the guest immediately.","status":"published","published":"2023-09-11T04:15:10.72Z","modified":"2026-06-17T06:23:53.76Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-369"],"updated_at":"2026-11-02T14:08:28.268644Z"}],"osv":[{"id":"AZL-35172","title":"CVE-2023-42467 affecting package qemu for versions less than 8.2.0-1","description":"QEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset in hw/scsi/scsi-disk.c because scsi_disk_emulate_mode_select does not prevent s-\u003eqdev.blocksize from being 256. This stops QEMU and the guest immediately.","status":"published","published":"2023-09-11T04:15:10Z","modified":"2026-04-21T04:53:54.663323Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:04.173658Z"},{"id":"BELL-CVE-2023-42467","status":"published","published":"2023-09-11T04:15:00Z","modified":"2026-01-26T09:35:30.065806Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:28:17.742221Z"},{"id":"DEBIAN-CVE-2023-42467","description":"QEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset in hw/scsi/scsi-disk.c because scsi_disk_emulate_mode_select does not prevent s-\u003eqdev.blocksize from being 256. This stops QEMU and the guest immediately.","status":"published","published":"2023-09-11T04:15:10.72Z","modified":"2026-10-26T18:02:32.827384232Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:40.275853Z"},{"id":"RHSA-2024:2135","title":"Red Hat Security Advisory: qemu-kvm security update","status":"published","published":"2024-09-13T23:57:39Z","modified":"2026-06-28T11:08:35Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"ALSA-2024:2135","title":"Moderate: qemu-kvm security update","description":"Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.\n\nSecurity Fix(es):\n\n* QEMU: e1000e: heap use-after-free in e1000e_write_packet_to_guest() (CVE-2023-3019)\n* QEMU: VNC: infinite loop in inflate_buffer() leads to denial of service (CVE-2023-3255)\n* QEMU: improper IDE controller reset can lead to MBR overwrite (CVE-2023-5088)\n* QEMU: VNC: NULL pointer dereference in qemu_clipboard_request() (CVE-2023-6683)\n* QEMU: am53c974: denial of service due to division by zero (CVE-2023-42467)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.","status":"published","published":"2024-04-30T00:00:00Z","modified":"2026-10-29T11:31:42.657281414Z","updated_at":"2026-11-02T15:27:52.553233Z"},{"id":"CLSA-2026-1778125769","title":"qemu-kvm: Fix of 3 CVEs","description":"- CVE-2023-3019: net: improper synchronization in net device backends\n- CVE-2023-42467: scsi-disk: division by zero in scsi_disk_emulate_mode_select\n- CVE-2024-26327: pcie_sriov: NumVFs validation buffer overflow","status":"published","published":"2026-05-07T03:49:36Z","modified":"2026-06-01T00:32:29.460726549Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CVE-2023-42467","description":"QEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset in hw/scsi/scsi-disk.c because scsi_disk_emulate_mode_select does not prevent s-\u003eqdev.blocksize from being 256. This stops QEMU and the guest immediately.","status":"published","published":"2023-09-11T00:00:00Z","modified":"2026-10-28T10:31:15.648293355Z","updated_at":"2026-11-02T15:44:33.792101Z"},{"id":"MGASA-2024-0387","title":"Updated qemu packages fix security vulnerabilities","description":"A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA\ndevice. This flaw allows a crafted guest driver to allocate and\ninitialize a huge number of page tables to be used as a ring of\ndescriptors for CQ and async events, potentially leading to an\nout-of-bounds read and crash of QEMU. (CVE-2023-1544)\nA DMA reentrancy issue leading to a use-after-free error was found in\nthe e1000e NIC emulation code in QEMU. This issue could allow a\nprivileged guest user to crash the QEMU process on the host, resulting\nin a denial of service. (CVE-2023-3019)\nA flaw was found in the QEMU built-in VNC server while processing\nClientCutText messages. A wrong exit condition may lead to an infinite\nloop when inflating an attacker controlled zlib buffer in the\n`inflate_buffer` function. This could allow a remote authenticated\nclient who is able to send a clipboard to the VNC server to trigger a\ndenial of service. (CVE-2023-3255)\nA bug in QEMU could cause a guest I/O operation otherwise addressed to\nan arbitrary disk offset to be targeted to offset 0 instead (potentially\noverwriting the VM's boot code). This could be used, for example, by L2\nguests with a virtual disk (vdiskL2) stored on a virtual disk of an L1\n(vdiskL1) hypervisor to read and/or write data to LBA 0 of vdiskL1,\npotentially gaining control of L1 at its next reboot. (CVE-2023-5088)\nA flaw was found in the QEMU built-in VNC server while processing\nClientCutText messages. The qemu_clipboard_request() function can be\nreached before vnc_server_cut_text_caps() was called and had the chance\nto initialize the clipboard peer, leading to a NULL pointer dereference.\nThis could allow a malicious authenticated VNC client to crash QEMU and\ntrigger a denial of service. (CVE-2023-6683)\nA stack based buffer overflow was found in the virtio-net device of\nQEMU. This issue occurs when flushing TX in the virtio_net_flush_tx\nfunction if guest features VIRTIO_NET_F_HASH_REPORT, VIRTIO_F_VERSION_1\nand VIRTIO_NET_F_MRG_RXBUF are enabled. This could allow a malicious\nuser to overwrite local variables allocated on the stack. Specifically,\nthe `out_sg` variable could be used to read a part of process memory and\nsend it to the wire, causing an information leak. (CVE-2023-6693)\nQEMU through 8.0.0 could trigger a division by zero in scsi_disk_reset\nin hw/scsi/scsi-disk.c because scsi_disk_emulate_mode_select does not\nprevent s-\u003eqdev.blocksize from being 256. This stops QEMU and the guest\nimmediately. (CVE-2023-42467)\nQEMU before 8.2.0 has an integer underflow, and resultant buffer\noverflow, via a TI command when an expected non-DMA transfer length is\nless than the length of the available FIFO data. This occurs in\nesp_do_nodma in hw/scsi/esp.c because of an underflow of async_len.\n(CVE-2024-24474)\nAn issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in\nhw/pci/pcie_sriov.c mishandles the situation where a guest writes NumVFs\ngreater than TotalVFs, leading to a buffer overflow in VF\nimplementations. (CVE-2024-26327)\nAn issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in\nhw/pci/pcie_sriov.c does not set NumVFs to PCI_SRIOV_TOTAL_VF, and thus\ninteraction with hw/nvme/ctrl.c is mishandled. (CVE-2024-26328)\nA double free vulnerability was found in QEMU virtio devices\n(virtio-gpu, virtio-serial-bus, virtio-crypto), where the\nmem_reentrancy_guard flag insufficiently protects against DMA reentrancy\nissues. This issue could allow a malicious privileged guest user to\ncrash the QEMU process on the host, resulting in a denial of service or\nallow arbitrary code execution within the context of the QEMU process on\nthe host. (CVE-2024-3446)\nA heap-based buffer overflow was found in the SDHCI device emulation of\nQEMU. The bug is triggered when both `s-\u003edata_count` and the size of\n`s-\u003efifo_buffer` are set to 0x200, leading to an out-of-bound access. A\nmalicious guest could use this flaw to crash the QEMU process on the\nhost, resulting in a denial of service condition. (CVE-2024-3447)\nA flaw was found in the QEMU disk image utility (qemu-img) 'info'\ncommand. A specially crafted image file containing a `json:{}` value\ndescribing block devices in QMP could cause the qemu-img process on the\nhost to consume large amounts of memory or CPU time, leading to denial\nof service or read/write to an existing external file. (CVE-2024-4467)\nA flaw was found in the QEMU NBD Server. This vulnerability allows a\ndenial of service (DoS) attack via improper synchronization during\nsocket closure when a client keeps a socket open as the server is taken\noffline. (CVE-2024-7409)\nA flaw was found in QEMU. An assertion failure was present in the\nusb_ep_get() function in hw/net/core.c when trying to get the USB\nendpoint from a USB device. This flaw may allow a malicious unprivileged\nguest user to crash the QEMU process on the host and cause a denial of\nservice condition. (CVE-2024-8354)\nA flaw was found in QEMU, in the virtio-scsi, virtio-blk, and\nvirtio-crypto devices. The size for virtqueue_push as set in\nvirtio_scsi_complete_req / virtio_blk_req_complete /\nvirito_crypto_req_complete could be larger than the true size of the\ndata which has been sent to guest. Once virtqueue_push() finally calls\ndma_memory_unmap to ummap the in_iov, it may call the\naddress_space_write function to write back the data. Some uninitialized\ndata may exist in the bounce.buffer, leading to an information leak.\n(CVE-2024-8612)\n","status":"published","published":"2024-12-04T16:58:15Z","modified":"2026-04-16T04:44:09.257202401Z","updated_at":"2026-11-02T15:49:42.684501Z"},{"id":"openSUSE-SU-2024:13364-1","title":"qemu-8.1.2-1.1 on GA media","description":"These are all security issues fixed in the qemu-8.1.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:38:34.699742Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"RLSA-2024:2135","title":"Moderate: qemu-kvm security update","description":"Kernel-based Virtual Machine (KVM) is a full virtualization solution for Linux on a variety of architectures. The qemu-kvm packages provide the user-space component for running virtual machines that use KVM.\n\nSecurity Fix(es):\n\n* QEMU: e1000e: heap use-after-free in e1000e_write_packet_to_guest() (CVE-2023-3019)\n\n* QEMU: VNC: infinite loop in inflate_buffer() leads to denial of service (CVE-2023-3255)\n\n* QEMU: improper IDE controller reset can lead to MBR overwrite (CVE-2023-5088)\n\n* QEMU: VNC: NULL pointer dereference in qemu_clipboard_request() (CVE-2023-6683)\n\n* QEMU: am53c974: denial of service due to division by zero (CVE-2023-42467)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Rocky Linux 9.4 Release Notes linked from the References section.","status":"published","published":"2024-05-10T14:32:42.380544Z","modified":"2026-02-04T14:00:11.281071Z","updated_at":"2026-11-02T15:53:24.63379Z"},{"id":"SUSE-SU-2025:0516-1","title":"Security update for qemu","description":"This update for qemu fixes the following issues:\n\n- CVE-2023-42467: Disallow block sizes smaller than 512 (bsc#1215192).\n","status":"published","published":"2025-02-13T11:59:06Z","modified":"2026-02-04T02:49:57.106456Z","updated_at":"2026-11-02T15:53:58.883365Z"}]}}