AZL-35162

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-35162.json

JSON Data

https://api.osv.dev/v1/vulns/AZL-35162

Upstream

CVE-2022-36648

Published

2023-08-22T19:16:23Z

Modified

2026-04-21T04:27:55.231345Z

Severity

10.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H CVSS Calculator

Summary

CVE-2022-36648 affecting package qemu for versions less than 6.2.0-18

Details

The hardware emulation in the ofdpacmdaddl2_flood of rocker device model in QEMU, as used in 7.0.0 and earlier, allows remote attackers to crash the host qemu and potentially execute code on the host via execute a malformed program in the guest OS. Note: This has been disputed by multiple third parties as not a valid vulnerability due to the rocker device not falling within the virtualization use case.

References

https://nvd.nist.gov/vuln/detail/CVE-2022-36648

Affected packages

Azure Linux:3 / qemu

Package

Name: qemu
Purl: pkg:rpm/azure-linux/qemu

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

6.2.0-18

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-35162.json"