PT-2022-6798 · Qemu+4 · Qemu+4

Ningqiang + 2 · Published 2022-11-07 · Updated 2025-05-05 · CVE-2022-3872

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions QEMU (affected versions not specified)

Description The issue is related to an off-by-one read/write problem in the SDHCI device of QEMU. It occurs when reading or writing the Buffer Data Port Register in sdhci read dataport and sdhci write dataport functions, respectively, if data count equals block size. A malicious guest could exploit this flaw to crash the QEMU process on the host, resulting in a denial of service condition.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Weakness Enumeration

CWE-193

Related Identifiers

ALT-PU-2022-3429

ALT-PU-2023-1830

ALT-PU-2023-1869

AZL-11441

AZL-35163

BDU:2023-04792

CVE-2022-3872

ECHO-6871-872A-D66E

Affected Products

Alt Linux

Astra Linux

Debian

Qemu

Red Os

References · 22

• 🔥 https://github.com/QiuhaoLi/CVE-2021-3929-3947 · Exploit
• https://lists.nongnu.org/archive/html/qemu-devel/2022-11/msg01068.html · Patch
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-04792 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-3872 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3872 · Security Note
• https://ubuntu.com/security/CVE-2022-3872 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2022-3872 · Security Note
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0727SE47 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-35163 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-3872 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-3872 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-11441 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-3872 · Vendor Advisory
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/uyazvimost-qemu-cve-2022-3872 · Note