Cheolwoo Myung

**Name of the Vulnerable Software and Affected Versions** QEMU (affected versions not specified) **Description** An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits (tx) descriptors in `process tx desc` if various descriptor fields are initialized with invalid values. This flaw allows a guest to consume CPU cycles on the host, resulting in a denial of service. The highest threat from this vulnerability is to system availability. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** QEMU versions 2.10.0 through 5.2.0 **Description** A use-after-free flaw was found in the MegaRAID emulator of QEMU. This issue occurs while processing SCSI I/O requests in the case of an error in the `mptsas free request()` function that does not dequeue the request object `req` from a pending requests queue. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. **Recommendations** For versions 2.10.0 through 5.2.0, consider disabling the `mptsas free request()` function as a temporary workaround until a patch is available. Restrict access to the MegaRAID emulator to minimize the risk of exploitation. Avoid using the `req` object in the affected SCSI I/O requests until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** QEMU versions prior to 6.0.0 **Description** The issue is related to a use-after-free vulnerability in the am53c974 SCSI host bus adapter emulation of QEMU. This vulnerability can be exploited to gain access to confidential data, compromise data integrity, and cause a denial of service. A privileged guest user can crash the QEMU process on the host, potentially leading to code execution with the privileges of the QEMU process. The vulnerability is triggered during the handling of the 'Information Transfer' command (CMD TI). **Recommendations** For versions prior to 6.0.0, update to version 6.0.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the am53c974 SCSI host bus adapter emulation to minimize the risk of exploitation. Avoid using the 'Information Transfer' command (CMD TI) in the affected QEMU process until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** QEMU versions prior to 6.0.0 **Description** A NULL pointer dereference flaw was found in the SCSI emulation support of QEMU. This flaw allows a privileged guest user to crash the QEMU process on the host, resulting in a denial of service. The highest threat from this issue is to system availability. **Recommendations** For versions prior to 6.0.0, update to version 6.0.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the SCSI emulation support to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** QEMU (affected versions not specified) **Description** A reachable assertion issue was found in the USB EHCI emulation code of QEMU. It could occur while processing USB requests due to missing handling of DMA memory map failure. A malicious privileged user within the guest may abuse this flaw to send bogus USB requests and crash the QEMU process on the host, resulting in a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.