CVE-2022-26354

NameCVE-2022-26354
DescriptionA flaw was found in the vhost-vsock device of QEMU. In case of error, an invalid element was not detached from the virtqueue before freeing its memory, leading to memory leakage and other unexpected results. Affected QEMU versions <= 6.2.0.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDLA-2970-1, DLA-3099-1, DSA-5133-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
qemu (PTS)jessie, jessie (lts)1:2.1+dfsg-12+deb8u23fixed
stretch (security)1:2.8+dfsg-6+deb9u17fixed
stretch (lts), stretch1:2.8+dfsg-6+deb9u19fixed
buster1:3.1+dfsg-8+deb10u8vulnerable
buster (security)1:3.1+dfsg-8+deb10u12fixed
bullseye1:5.2+dfsg-11+deb11u3fixed
bullseye (security)1:5.2+dfsg-11+deb11u2fixed
bookworm1:7.2+dfsg-7+deb12u6fixed
trixie1:8.2.4+ds-1fixed
sid1:9.0.2+ds-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
qemusourcejessie(not affected)
qemusourcestretch1:2.8+dfsg-6+deb9u17DLA-2970-1
qemusourcebuster1:3.1+dfsg-8+deb10u9DLA-3099-1
qemusourcebullseye1:5.2+dfsg-11+deb11u2DSA-5133-1
qemusource(unstable)1:7.0+dfsg-1

Notes

https://bugzilla.redhat.com/show_bug.cgi?id=2063257
https://gitlab.com/qemu-project/qemu/-/commit/8d1b247f3748ac4078524130c6d7ae42b6140aaf
vulnerable code in buster in vhost_vsock_send_transport_reset
[jessie] - qemu <not-affected> (vulnerable code was introduced later)

Search for package or bug name: Reporting problems