NULL pointer dereference in QEMU - CVE-2022-36648

Vulnerability identifier: #VU95530

CSH Severity: Low

CVSS v4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-36648

CWE-ID: CWE-476

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error within hardware emulation in the of_dpa_cmd_add_l2_flood of rocker device model in QEMU. A local user can crash a host OS.

QEMU
openEuler
qemu-seabios
qemu
qemu-block-curl
qemu-block-iscsi
qemu-block-rbd
qemu-block-ssh
qemu-debuginfo
qemu-debugsource
qemu-guest-agent
qemu-img
qemu-system-aarch64
qemu-system-arm
qemu-system-riscv
qemu-system-x86_64
qemu-help
qemu-hw-usb-host
qemu-user
qemu-user-binfmt
qemu-user-static

Install updates from vendor's website.

qemu-seabios - addressed in versions 6.2.0-115, 8.2.0-57, 8.2.0-81
qemu - addressed in versions 6.2.0-115, 8.2.0-57, 8.2.0-81
qemu-block-curl - addressed in versions 6.2.0-115, 8.2.0-57, 8.2.0-81
qemu-block-iscsi - addressed in versions 6.2.0-115, 8.2.0-57, 8.2.0-81
qemu-block-rbd - addressed in versions 6.2.0-115, 8.2.0-57, 8.2.0-81
qemu-block-ssh - addressed in versions 6.2.0-115, 8.2.0-57, 8.2.0-81
qemu-debuginfo - addressed in versions 6.2.0-115, 8.2.0-57, 8.2.0-81
qemu-debugsource - addressed in versions 6.2.0-115, 8.2.0-57, 8.2.0-81
qemu-guest-agent - addressed in versions 6.2.0-115, 8.2.0-57, 8.2.0-81
qemu-img - addressed in versions 6.2.0-115, 8.2.0-57, 8.2.0-81
qemu-system-aarch64 - addressed in versions 6.2.0-115, 8.2.0-57, 8.2.0-81
qemu-system-arm - addressed in versions 6.2.0-115, 8.2.0-57, 8.2.0-81
qemu-system-riscv - addressed in versions 6.2.0-115, 8.2.0-57, 8.2.0-81
qemu-system-x86_64 - addressed in versions 6.2.0-115, 8.2.0-57, 8.2.0-81
qemu-help - addressed in versions 6.2.0-115, 8.2.0-57, 8.2.0-81
qemu-hw-usb-host - addressed in versions 6.2.0-115, 8.2.0-57, 8.2.0-81
qemu-user - addressed in versions 8.2.0-57, 8.2.0-81
qemu-user-binfmt - addressed in versions 8.2.0-57, 8.2.0-81
qemu-user-static - addressed in versions 8.2.0-57, 8.2.0-81

• https://lists.nongnu.org/archive/html/qemu-devel/2022-06/msg04469.html
• https://security.netapp.com/advisory/ntap-20231006-0004/

• Denial of service in QEMU
• openEuler 24.03 LTS SP4 update for qemu
• openEuler 24.03 LTS SP1 update for qemu
• openEuler 22.03 LTS SP4 update for qemu
• openEuler 24.03 LTS SP3 update for qemu