CVE-2022-4172

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-4172
An integer overflow and buffer overflow issues were found in the ACPI Error Record Serialization Table (ERST) device of QEMU in the read_erst_record() and write_erst_record() functions. Both issues may allow the guest to overrun the host buffer allocated for the ERST memory device. A malicious guest could use these flaws to crash the QEMU process on the host.

6.5 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.0 / Impact : 4.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope CHANGED

References
Link Resource
https://gitlab.com/qemu-project/qemu/-/commit/defb7098 Patch Third Party Advisory
https://gitlab.com/qemu-project/qemu/-/commit/defb7098 Patch Third Party Advisory
https://gitlab.com/qemu-project/qemu/-/issues/1268 Exploit Issue Tracking Third Party Advisory
https://gitlab.com/qemu-project/qemu/-/issues/1268 Exploit Issue Tracking Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I7J5IRXJYLELW7D43A75LOWRUE5EU54O/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I7J5IRXJYLELW7D43A75LOWRUE5EU54O/
https://lore.kernel.org/qemu-devel/20221024154233.1043347-1-lk%40c--e.de/
https://lore.kernel.org/qemu-devel/20221024154233.1043347-1-lk%40c--e.de/
https://security.netapp.com/advisory/ntap-20230127-0013/ Third Party Advisory
https://security.netapp.com/advisory/ntap-20230127-0013/ Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:qemu:qemu:7.0.0:-:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
History

14 Apr 2025, 18:15

Type Values Removed Values Added
CWE CWE-120
References (MISC) https://gitlab.com/qemu-project/qemu/-/commit/defb7098 - Patch, Third Party Advisory () https://gitlab.com/qemu-project/qemu/-/commit/defb7098 - Patch, Third Party Advisory
References (CONFIRM) https://security.netapp.com/advisory/ntap-20230127-0013/ - Third Party Advisory () https://security.netapp.com/advisory/ntap-20230127-0013/ - Third Party Advisory
References (MISC) https://gitlab.com/qemu-project/qemu/-/issues/1268 - Exploit, Issue Tracking, Third Party Advisory () https://gitlab.com/qemu-project/qemu/-/issues/1268 - Exploit, Issue Tracking, Third Party Advisory

07 Nov 2023, 03:57

Type Values Removed Values Added
CWE CWE-190
References
  • {'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/I7J5IRXJYLELW7D43A75LOWRUE5EU54O/', 'name': 'FEDORA-2022-22b1f8dae2', 'tags': ['Mailing List', 'Third Party Advisory'], 'refsource': 'FEDORA'}
  • {'url': 'https://lore.kernel.org/qemu-devel/20221024154233.1043347-1-lk@c--e.de/', 'name': 'https://lore.kernel.org/qemu-devel/20221024154233.1043347-1-lk@c--e.de/', 'tags': ['Patch', 'Vendor Advisory'], 'refsource': 'MISC'}
  • () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/I7J5IRXJYLELW7D43A75LOWRUE5EU54O/ -
  • () https://lore.kernel.org/qemu-devel/20221024154233.1043347-1-lk%40c--e.de/ -
Information

Published : 2022-11-29 18:15

Updated : 2025-04-14 18:15

NVD link : CVE-2022-4172

Mitre link : CVE-2022-4172

JSON object : View

Products Affected

qemu

  • qemu

fedoraproject

  • fedora
CWE

No CWE.