CVE-2022-36648

Katalog CVE

CVSS 10.0 · Critical EPSS 1,7%

Kerentanan NULL Pointer Dereference pada qemu. Skor CVSS 3.1 10.0 (Critical) menurut NVD.

Deskripsi (NVD)

The hardware emulation in the of_dpa_cmd_add_l2_flood of rocker device model in QEMU, as used in 7.0.0 and earlier, allows remote attackers to crash the host qemu and potentially execute code on the host via execute a malformed program in the guest OS. Note: This has been disputed by multiple third parties as not a valid vulnerability due to the rocker device not falling within the virtualization use case.

Rincian

Terbit di NVD

22 Agustus 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

10.0 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-476: NULL Pointer Dereference

EPSS (30 hari)

1,7% peluang dieksploitasi; lebih tinggi dari 77,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.nongnu.org/archive/html/qemu-devel/2022-06/msg04469.html mailing list · patch
• https://security.netapp.com/advisory/ntap-20231006-0004/