Gerd Hoffmann

5 exploits Active since Jul 2017
CVE-2021-3527 WRITEUP MEDIUM WRITEUP
QEMU < 6.0.0 - Denial of Service via USB Redirector Device Stack Allocation
A flaw was found in the USB redirector device (usb-redir) of QEMU. Small USB packets are combined into a single, large transfer request, to reduce the overhead and improve performance. The combined size of the bulk transfer is used to dynamically allocate a variable length array (VLA) on the stack without proper validation. Since the total size is not bounded, a malicious guest could use this flaw to influence the array length and cause the QEMU process to perform an excessive allocation on the stack, resulting in a denial of service.
CVSS 5.5
CVE-2023-2008 WRITEUP HIGH WRITEUP
Linux Kernel < 5.19 - Privilege Escalation via udmabuf Fault Handler Array Index Validation
A flaw was found in the Linux kernel's udmabuf device driver. The specific flaw exists within a fault handler. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an array. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the kernel.
CVSS 7.8
CVE-2021-3527 WRITEUP MEDIUM WRITEUP
QEMU < 6.0.0 - Denial of Service via USB Redirector Device Stack Allocation
A flaw was found in the USB redirector device (usb-redir) of QEMU. Small USB packets are combined into a single, large transfer request, to reduce the overhead and improve performance. The combined size of the bulk transfer is used to dynamically allocate a variable length array (VLA) on the stack without proper validation. Since the total size is not bounded, a malicious guest could use this flaw to influence the array length and cause the QEMU process to perform an excessive allocation on the stack, resulting in a denial of service.
CVSS 5.5
CVE-2015-5239 WRITEUP MEDIUM WRITEUP
QEMU < 2.1.0 - Denial of Service via VNC CLIENT_CUT_TEXT Message
Integer overflow in the VNC display driver in QEMU before 2.1.0 allows attachers to cause a denial of service (process crash) via a CLIENT_CUT_TEXT message, which triggers an infinite loop.
CVSS 6.5
CVE-2017-10810 WRITEUP HIGH WRITEUP
Linux Kernel < 4.4.77 - Memory Leak in virtio_gpu_object_create
Memory leak in the virtio_gpu_object_create function in drivers/gpu/drm/virtio/virtgpu_object.c in the Linux kernel through 4.11.8 allows attackers to cause a denial of service (memory consumption) by triggering object-initialization failures.
CVSS 7.5