<p>Upgrade <code>AlmaLinux:9</code> <code>qemu-kvm-device-usb-redirect</code> to version 17:7.2.0-14.el9_2 or higher.<br>This issue was patched in <code>ALSA-2023:2162</code>.</p>

Integer Underflow Affecting qemu-kvm-device-usb-redirect package, versions <17:7.2.0-14.el9_2

Threat Intelligence

0.17% (56^th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk ID SNYK-ALMALINUX9-QEMUKVMDEVICEUSBREDIRECT-5632883
published 28 May 2023
disclosed 16 May 2023

Report a new vulnerability Found a mistake?

Introduced: 16 May 2023

CVE-2022-3165 Open this link in a new tab CWE-191 Open this link in a new tab

How to fix?

Upgrade AlmaLinux:9 qemu-kvm-device-usb-redirect to version 17:7.2.0-14.el9_2 or higher.
This issue was patched in ALSA-2023:2162.

NVD Description

Note: Versions mentioned in the description apply only to the upstream qemu-kvm-device-usb-redirect package and not the qemu-kvm-device-usb-redirect package as distributed by AlmaLinux. See How to fix? for AlmaLinux:9 relevant fixed versions and status.

An integer underflow issue was found in the QEMU VNC server while processing ClientCutText messages in the extended format. A malicious client could use this flaw to make QEMU unresponsive by sending a specially crafted payload message, resulting in a denial of service.

References

CVSS Scores

version 3.1

Attack Vector (AV)

Network
Attack Complexity (AC)

Low
Privileges Required (PR)

Low
User Interaction (UI)

None

Scope (S)

Unchanged

Confidentiality (C)

None
Integrity (I)

None
Availability (A)

High

Integer Underflow Affecting qemu-kvm-device-usb-redirect package, versions <17:7.2.0-14.el9_2

Severity

Based on AlmaLinux security rating