CVE-2022-3872
moderate-risk
Published 2022-11-07
An off-by-one read/write issue was found in the SDHCI device of QEMU. It occurs when reading/writing the Buffer Data Port Register in sdhci_read_dataport and sdhci_write_dataport, respectively, if data_count == block_size. A malicious guest could use this flaw to crash the QEMU process on the host, resulting in a denial of service condition.
Do I need to act?
-
0.08% chance of exploitation
EPSS score — low exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
8
CVSS 8.6/10
High
NETWORK
/ LOW complexity
Affected Vendors
References (4)
Third Party Advisory
https://security.netapp.com/advisory/ntap-20221215-0005/
Third Party Advisory
https://security.netapp.com/advisory/ntap-20221215-0005/
43
/ 100
moderate-risk
Severity
29/34 · Critical
Exploitability
0/34 · Minimal
Exposure
14/34 · Moderate