CVE-2022-36648

    Dashboard / Vulnerabilities / CVE-2022-36648

    CVE-2022-36648

    Published: 22 Aug 2023Last Modified: 12 Aug 2026

    Summary:

    Details: The hardware emulation in the of_dpa_cmd_add_l2_flood of rocker device model in QEMU, as used in 7.0.0 and earlier, allows remote attackers to crash the host qemu and potentially execute code on the host via execute a malformed program in the guest OS. Note: This has been disputed by multiple third parties as not a valid vulnerability due to the rocker device not falling within the virtualization use case.

    References: https://lists.nongnu.org/archive/html/qemu-devel/2022-06/msg04469.html, https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36648.json, https://nvd.nist.gov/vuln/detail/CVE-2022-36648, https://security.netapp.com/advisory/ntap-20231006-0004/

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    v7.0.0
    v7.0.0-rc4
    v7.0.0-rc3
    v7.0.0-rc2
    v7.0.0-rc1
    v7.0.0-rc0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-36648 | CVE-DB