CVE-2022-26354

Katalog CVE

CVSS 3.2 · Low EPSS 0,39%

Kerentanan Missing Release of Resource after Effective Lifetime pada qemu, debian linux. Skor CVSS 3.1 3.2 (Low) menurut NVD.

Deskripsi (NVD)

A flaw was found in the vhost-vsock device of QEMU. In case of error, an invalid element was not detached from the virtqueue before freeing its memory, leading to memory leakage and other unexpected results. Affected QEMU versions <= 6.2.0.

Rincian

Terbit di NVD

16 Maret 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

3.2 (Low), sumber NVD
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:N/I:N/A:L · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-772: Missing Release of Resource after Effective Lifetime

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 31,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gitlab.com/qemu-project/qemu/-/commit/8d1b247f3748ac4078524130c6d7ae42b6140aaf patch · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2022/04/msg00002.html mailing list · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2022/09/msg00008.html mailing list · advisory pihak ketiga
• https://security.gentoo.org/glsa/202208-27 advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20220425-0003/ advisory pihak ketiga
• https://www.debian.org/security/2022/dsa-5133 advisory pihak ketiga