Vulnerability · Published Sep 13, 2022 · Assigned by redhat
CVE-2022-2962
High 7.8
In plain English
A high-severity uncontrolled resource consumption in QEMU. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A DMA reentrancy issue was found in the Tulip device emulation in QEMU. When Tulip reads or writes to the rx/tx descriptor or copies the rx/tx frame, it doesn't check whether the destination address is its own MMIO address. This can cause the device to trigger MMIO handlers multiple times, possibly leading to a stack or heap overflow. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | qemu | 7.1.0-r4 | ALPINE-CVE-2022-2962 |
| Alpine:v3.21 | qemu | 7.1.0-r4 | ALPINE-CVE-2022-2962 |
| Alpine:v3.22 | qemu | 7.1.0-r4 | ALPINE-CVE-2022-2962 |
| Alpine:v3.23 | qemu | 7.1.0-r4 | ALPINE-CVE-2022-2962 |
| Alpine:v3.24 | qemu | 7.1.0-r4 | ALPINE-CVE-2022-2962 |
| Debian:12 | qemu | 1:7.1+dfsg-2 | DEBIAN-CVE-2022-2962 |
| Debian:13 | qemu | 1:7.1+dfsg-2 | DEBIAN-CVE-2022-2962 |
| Debian:14 | qemu | 1:7.1+dfsg-2 | DEBIAN-CVE-2022-2962 |
Affected products (as reported)
Weakness: CWE-400 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://gitlab.com/qemu-project/qemu/-/issues/1171 x_refsource_MISC
- https://gitlab.com/qemu-project/qemu/-/commit/36a894aeb64a2e02871016da1c37d4a4ca109182 x_refsource_MISC