Remote Code Execution and Crash Vulnerability in QEMU Rocker Device Model
CVE-2022-36648

10CRITICAL

Key Information:

Vendor

Qemu
Status
Qemu
Vendor
CVE Published:
22 August 2023

What is CVE-2022-36648?

The vulnerability in the hardware emulation of the rocker device model in QEMU allows remote attackers to execute malformed programs, potentially causing a crash of the host QEMU instance. This may lead to unauthorized code execution within the host system environment when a malicious payload is run in the guest operating system. While there has been some dispute regarding the validity of this issue due to the device's context in virtualization scenarios, users of QEMU versions 7.0.0 and earlier should remain vigilant to mitigate any associated risks.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

References

https://lists.nongnu.org/archive/html/qemu-devel/2022-06/...
https://security.netapp.com/advisory/ntap-20231006-0004/

CVSS V3.1

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.