Vulnerability Description
An integer overflow and buffer overflow issues were found in the ACPI Error Record Serialization Table (ERST) device of QEMU in the read_erst_record() and write_erst_record() functions. Both issues may allow the guest to overrun the host buffer allocated for the ERST memory device. A malicious guest could use these flaws to crash the QEMU process on the host.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Qemu | Qemu | 7.0.0 |
| Fedoraproject | Fedora | 37 |
Related Weaknesses (CWE)
References
- https://gitlab.com/qemu-project/qemu/-/commit/defb7098PatchThird Party Advisory
- https://gitlab.com/qemu-project/qemu/-/issues/1268ExploitIssue TrackingThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lore.kernel.org/qemu-devel/20221024154233.1043347-1-lk%40c--e.de/
- https://security.netapp.com/advisory/ntap-20230127-0013/Third Party Advisory
- https://gitlab.com/qemu-project/qemu/-/commit/defb7098PatchThird Party Advisory
- https://gitlab.com/qemu-project/qemu/-/issues/1268ExploitIssue TrackingThird Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lore.kernel.org/qemu-devel/20221024154233.1043347-1-lk%40c--e.de/
- https://security.netapp.com/advisory/ntap-20230127-0013/Third Party Advisory
FAQ
What is CVE-2022-4172?
CVE-2022-4172 is a vulnerability with a CVSS score of 6.5 (MEDIUM). An integer overflow and buffer overflow issues were found in the ACPI Error Record Serialization Table (ERST) device of QEMU in the read_erst_record() and write_erst_record() functions. Both issues ma...
How severe is CVE-2022-4172?
CVE-2022-4172 has been rated MEDIUM with a CVSS base score of 6.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-4172?
Check the references section above for vendor advisories and patch information. Affected products include: Qemu Qemu, Fedoraproject Fedora.