CVE-2022-3872
Published: 7 November 2022
An off-by-one read/write issue was found in the SDHCI device of QEMU. It occurs when reading/writing the Buffer Data Port Register in sdhci_read_dataport and sdhci_write_dataport, respectively, if data_count == block_size. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.
Notes
| Author | Note |
|---|---|
| 0xnishit |
As of 2024-08-19, patch is not commited to upstream |
Priority
Status
| Package | Release | Status |
|---|---|---|
|
qemu
Launchpad, Ubuntu, Debian |
bionic |
Deferred
(2024-08-19)
|
| focal |
Deferred
(2024-08-19)
|
|
| jammy |
Deferred
(2024-08-19)
|
|
| kinetic |
Ignored
(end of life, was deferred [2024-08-19])
|
|
| lunar |
Ignored
(end of life, was deferred [2024-08-19])
|
|
| mantic |
Ignored
(end of life, was deferred [2024-08-19])
|
|
| noble |
Deferred
(2024-08-19)
|
|
| trusty |
Deferred
(2024-08-19)
|
|
| upstream |
Needs triage
|
|
| xenial |
Deferred
(2024-08-19)
|
|
|
Patches:
upstream: https://lists.nongnu.org/archive/html/qemu-devel/2022-11/msg01068.html upstream: https://lists.nongnu.org/archive/html/qemu-devel/2022-11/msg01161.html |
||
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score | 8.6 |
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Changed |
| Confidentiality | None |
| Integrity impact | None |
| Availability impact | High |
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H |