QEMU: qxl: null pointer dereference while releasing spice resources
Published May 24, 2019
7.5
HIGHCVSS 3.0
EPSS 5.55%
Description
interface_release_resource in hw/display/qxl.c in QEMU 3.1.x through 4.0.0 has a NULL pointer dereference.
Affected products
No data.
No data.
Advanced Virtualization for RHEL 8.1.0
virt-devel:8.1-8010020190927171011.cdc1202b
Fixed · RHBA-2019:3723
Advanced Virtualization for RHEL 8.1.0
virt:8.1-8010020190927171011.cdc1202b
Fixed · RHBA-2019:3723
Red Hat Enterprise Linux 6
qemu-kvm-2:0.12.1.2-2.506.el6_10.5
Fixed · RHSA-2019:2892
Red Hat Enterprise Linux 7
qemu-kvm-10:1.5.3-167.el7_7.1
Fixed · RHSA-2019:2607
Red Hat Enterprise Linux 8
virt-devel:rhel-8010020190916153839.cdc1202b
Fixed · RHSA-2019:3345
Red Hat Enterprise Linux 8
virt:rhel-8010020190916153839.cdc1202b
Fixed · RHSA-2019:3345
Red Hat OpenStack Platform 10.0 (Newton)
qemu-kvm-rhev-10:2.12.0-33.el7_7.4
Fixed · RHSA-2019:4344
Red Hat OpenStack Platform 13.0 (Queens)
qemu-kvm-rhev-10:2.12.0-33.el7_7.4
Fixed · RHSA-2019:3787
Red Hat OpenStack Platform 14.0 (Rocky)
qemu-kvm-rhev-10:2.12.0-33.el7_7.4
Fixed · RHSA-2019:3742
Red Hat Virtualization 4 for Red Hat Enterprise Linux 7
qemu-kvm-rhev-10:2.12.0-33.el7_7.4
Fixed · RHSA-2019:3179
Red Hat Virtualization 4 for Red Hat Enterprise Linux 7
qemu-kvm-rhev-10:2.12.0-44.el7
Fixed · RHSA-2020:1216
Red Hat Virtualization Engine 4.3
qemu-kvm-rhev-10:2.12.0-33.el7_7.4
Fixed · RHSA-2019:3179
Red Hat Virtualization Engine 4.3
qemu-kvm-rhev-10:2.12.0-44.el7
Fixed · RHSA-2020:1216
Red Hat Enterprise Linux 5
kvm
Will not fix
Red Hat Enterprise Linux 5
xen
Not affected
Red Hat Enterprise Linux 7
qemu-kvm-ma
Not affected
Red Hat Enterprise Linux 8 Advanced Virtualization
qemu-kvm
Affected
Red Hat OpenStack Platform 9 (Mitaka)
qemu-kvm-rhev
Fix deferred
| Product | Package | State | Advisory |
|---|---|---|---|
| Advanced Virtualization for RHEL 8.1.0 | virt-devel:8.1-8010020190927171011.cdc1202b | Fixed | RHBA-2019:3723 |
| Advanced Virtualization for RHEL 8.1.0 | virt:8.1-8010020190927171011.cdc1202b | Fixed | RHBA-2019:3723 |
| Red Hat Enterprise Linux 6 | qemu-kvm-2:0.12.1.2-2.506.el6_10.5 | Fixed | RHSA-2019:2892 |
| Red Hat Enterprise Linux 7 | qemu-kvm-10:1.5.3-167.el7_7.1 | Fixed | RHSA-2019:2607 |
| Red Hat Enterprise Linux 8 | virt-devel:rhel-8010020190916153839.cdc1202b | Fixed | RHSA-2019:3345 |
| Red Hat Enterprise Linux 8 | virt:rhel-8010020190916153839.cdc1202b | Fixed | RHSA-2019:3345 |
| Red Hat OpenStack Platform 10.0 (Newton) | qemu-kvm-rhev-10:2.12.0-33.el7_7.4 | Fixed | RHSA-2019:4344 |
| Red Hat OpenStack Platform 13.0 (Queens) | qemu-kvm-rhev-10:2.12.0-33.el7_7.4 | Fixed | RHSA-2019:3787 |
| Red Hat OpenStack Platform 14.0 (Rocky) | qemu-kvm-rhev-10:2.12.0-33.el7_7.4 | Fixed | RHSA-2019:3742 |
| Red Hat Virtualization 4 for Red Hat Enterprise Linux 7 | qemu-kvm-rhev-10:2.12.0-33.el7_7.4 | Fixed | RHSA-2019:3179 |
| Red Hat Virtualization 4 for Red Hat Enterprise Linux 7 | qemu-kvm-rhev-10:2.12.0-44.el7 | Fixed | RHSA-2020:1216 |
| Red Hat Virtualization Engine 4.3 | qemu-kvm-rhev-10:2.12.0-33.el7_7.4 | Fixed | RHSA-2019:3179 |
| Red Hat Virtualization Engine 4.3 | qemu-kvm-rhev-10:2.12.0-44.el7 | Fixed | RHSA-2020:1216 |
| Red Hat Enterprise Linux 5 | kvm | Will not fix | n/a |
| Red Hat Enterprise Linux 5 | xen | Not affected | n/a |
| Red Hat Enterprise Linux 7 | qemu-kvm-ma | Not affected | n/a |
| Red Hat Enterprise Linux 8 Advanced Virtualization | qemu-kvm | Affected | n/a |
| Red Hat OpenStack Platform 9 (Mitaka) | qemu-kvm-rhev | Fix deferred | n/a |
No package ranges for this CVE.
Remediation
No remediation recorded yet.
References (25)
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00000.html vendor-advisoryx_refsource_SUSE
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00008.html vendor-advisoryx_refsource_SUSE
- http://www.openwall.com/lists/oss-security/2019/05/22/1 x_refsource_CONFIRMExploitMailing ListThird Party Advisory
- https://access.redhat.com/errata/RHBA-2019:3723 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2019:2607 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2019:2892 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2019:3179 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2019:3345 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2019:3742 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2019:3787 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2019:4344 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/security/cve/CVE-2019-12155 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1712670 Issue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2019-3804 Advisory
- https://git.qemu.org/?p=qemu.git%3Ba=commit%3Bh=3be7eb2f47bf71db5f80fcf8750ea395dd5ffdd2 x_refsource_MISC
- https://lists.debian.org/debian-lts-announce/2019/09/msg00021.html mailing-listx_refsource_MLIST
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BOE3PVFPMWMXV3DGP2R3XIHAF2ZQU3FS/ vendor-advisoryx_refsource_FEDORA
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RVDHJB2QKXNDU7OFXIHIL5O5VN5QCSZL/ vendor-advisoryx_refsource_FEDORA
- https://lists.gnu.org/archive/html/qemu-devel/2019-05/msg01321.html x_refsource_MISCMailing ListPatchThird Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2019-12155
- https://seclists.org/bugtraq/2019/May/76 mailing-listx_refsource_BUGTRAQ
- https://usn.ubuntu.com/4191-1/ vendor-advisoryx_refsource_UBUNTU
- https://usn.ubuntu.com/4191-2/ vendor-advisoryx_refsource_UBUNTU
- https://www.cve.org/CVERecord?id=CVE-2019-12155
- https://www.debian.org/security/2019/dsa-4454 vendor-advisoryx_refsource_DEBIAN
Change history (0)
No recorded changes yet.
CVE.org / MITRE
CISA Vulnrichment
No data
GitHub
No data