Use-after-free vulnerability in hw/ide/ahci.c in QEMU, when built with IDE AHCI Emulation support, allows guest OS users to cause a denial of service (instance crash) or possibly execute arbitrary code via an invalid AHCI Native Command Queuing (NCQ) AIO command.
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory “belongs” to the code that operates on the new pointer.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Qemu | Qemu | * | 2.5.1.1 (including) |
| Red Hat Enterprise Linux OpenStack Platform 5.0 (Icehouse) for RHEL 7 | RedHat | qemu-kvm-rhev-10:2.3.0-31.el7_2.7 | * |
| Red Hat Enterprise Linux OpenStack Platform 6.0 (Juno) for RHEL 7 | RedHat | qemu-kvm-rhev-10:2.3.0-31.el7_2.7 | * |
| Red Hat Enterprise Linux OpenStack Platform 7.0 (Kilo) for RHEL 7 | RedHat | qemu-kvm-rhev-10:2.3.0-31.el7_2.7 | * |
| RHEV 3.6 For IBM Power Systems | RedHat | qemu-kvm-rhev-10:2.3.0-31.el7_2.7 | * |
| RHEV 3.X Hypervisor and Agents for RHEL-7 | RedHat | qemu-kvm-rhev-10:2.3.0-31.el7_2.7 | * |
| Qemu | Ubuntu | devel | * |
| Qemu | Ubuntu | esm-infra-legacy/trusty | * |
| Qemu | Ubuntu | trusty | * |
| Qemu | Ubuntu | trusty/esm | * |
| Qemu | Ubuntu | vivid | * |
| Qemu | Ubuntu | wily | * |
| Qemu-kvm | Ubuntu | precise | * |