CVE-2022-4144 Denial of service in QEMU (QXL device)
A malicious guest user can crash the QEMU host process via an out-of-bounds read in the QXL display device emulation, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-4144?
CVE-2022-4144 is a medium-severity denial of service vulnerability in Fedoraproject Extra Packages for Enterprise Linux, published on 29 Nov 2022. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
An out-of-bounds read flaw was found in the QXL display device emulation in QEMU. The qxl_phys2virt() function does not check the size of the structure pointed to by the guest physical address, potentially reading past the end of the bar space into adjacent pages. A malicious guest user could use this flaw to crash the QEMU process on the host causing a denial of service condition.
Weakness: CWE-125
Which versions are affected by CVE-2022-4144?
It affects 4 products.
Linux distribution packages (40)
SLOF AlmaLinux:8 | All versions | 20210217-1.module_el8.6.0+2880+7d9e3703 |
hivex AlmaLinux:8 | All versions | 1.3.18-23.module_el8.6.0+2880+7d9e3703 |
hivex AlmaLinux:8 | All versions | 1.3.18-23.module_el8.6.0+3161+a07c0ea5 |
hivex-devel AlmaLinux:8 | All versions | 1.3.18-23.module_el8.6.0+2880+7d9e3703 |
hivex-devel AlmaLinux:8 | All versions | 1.3.18-23.module_el8.6.0+3161+a07c0ea5 |
libguestfs AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3346+68867adb.alma |
libguestfs-appliance AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3346+68867adb.alma |
libguestfs-bash-completion AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3346+68867adb.alma |
libguestfs-devel AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3346+68867adb.alma |
libguestfs-gfs2 AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3346+68867adb.alma |
libguestfs-gobject AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3346+68867adb.alma |
libguestfs-gobject-devel AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3346+68867adb.alma |
libguestfs-inspect-icons AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3346+68867adb.alma |
libguestfs-java AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3346+68867adb.alma |
libguestfs-java-devel AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3346+68867adb.alma |
libguestfs-javadoc AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3346+68867adb.alma |
libguestfs-man-pages-ja AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3346+68867adb.alma |
libguestfs-man-pages-uk AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3346+68867adb.alma |
libguestfs-rescue AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3346+68867adb.alma |
libguestfs-rsync AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3346+68867adb.alma |
libguestfs-tools AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3346+68867adb.alma |
libguestfs-tools-c AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3346+68867adb.alma |
libguestfs-winsupport AlmaLinux:8 | All versions | 8.6-1.module_el8.6.0+2880+7d9e3703 |
libguestfs-winsupport AlmaLinux:8 | All versions | 8.6-1.module_el8.6.0+3161+a07c0ea5 |
libguestfs-xfs AlmaLinux:8 | All versions | 1:1.44.0-9.module_el8.7.0+3346+68867adb.alma |
libiscsi AlmaLinux:8 | All versions | 1.18.0-8.module_el8.6.0+2880+7d9e3703 |
libiscsi AlmaLinux:8 | All versions | 1.18.0-8.module_el8.6.0+3161+a07c0ea5 |
libiscsi-devel AlmaLinux:8 | All versions | 1.18.0-8.module_el8.6.0+2880+7d9e3703 |
libiscsi-devel AlmaLinux:8 | All versions | 1.18.0-8.module_el8.6.0+3161+a07c0ea5 |
libiscsi-utils AlmaLinux:8 | All versions | 1.18.0-8.module_el8.6.0+2880+7d9e3703 |
libiscsi-utils AlmaLinux:8 | All versions | 1.18.0-8.module_el8.6.0+3161+a07c0ea5 |
libnbd AlmaLinux:8 | All versions | 1.6.0-5.module_el8.6.0+2880+7d9e3703 |
libnbd AlmaLinux:8 | All versions | 1.6.0-5.module_el8.6.0+3161+a07c0ea5 |
libnbd-bash-completion AlmaLinux:8 | All versions | 1.6.0-5.module_el8.6.0+2880+7d9e3703 |
libnbd-devel AlmaLinux:8 | All versions | 1.6.0-5.module_el8.6.0+2880+7d9e3703 |
libnbd-devel AlmaLinux:8 | All versions | 1.6.0-5.module_el8.6.0+3161+a07c0ea5 |
libtpms AlmaLinux:8 | All versions | 0.9.1-1.20211126git1ff6fe1f43.module_el8.7.0+3346+68867adb |
libtpms-devel AlmaLinux:8 | All versions | 0.9.1-1.20211126git1ff6fe1f43.module_el8.7.0+3346+68867adb |
libvirt AlmaLinux:8 | All versions | 8.0.0-10.1.module_el8.7.0+3387+571b583b |
libvirt-client AlmaLinux:8 | All versions | 8.0.0-10.1.module_el8.7.0+3387+571b583b |
Products include Fedoraproject Extra Packages for Enterprise Linux, Fedoraproject Fedora, Qemu Qemu, Redhat Enterprise Linux.
How do I fix CVE-2022-4144?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-4144 being exploited?
There is no known exploitation of CVE-2022-4144 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Extra Packages for Enterprise Linux
- CVE-2023-34152 Command injection in ImageMagick
- CVE-2022-4170 Code injection in rxvt-unicode
- CVE-2022-40315 Moodle Minor SQL injection risk in admin user browsing
- CVE-2022-45152 Moodle blind Server-Side Request Forgery (SSRF) vulnerability in LTI provider library
- CVE-2022-24882 Server side NTLM does not properly check parameters in FreeRDP
All Fedoraproject Extra Packages for Enterprise Linux vulnerabilities
Sources
Also known as ALSA-2023:0099, AZL-11522, AZL-35164, DEBIAN-CVE-2022-4144, GHSA-rc5v-q774-439g, OESA-2022-2136 and 5 more.