CVE-2022-36648

A NULL pointer dereference bug was found in the rocker device (emulated ethernet switch) of QEMU. The rocker_tlv_parse_nested() function could return early because of no group ids in the group_tlvs array. In such case, the tlvs pointer is NULL and tlvs[i + 1] in the next for-loop iteration ends up dereferencing a NULL pointer.

Red Hat Enterprise Linux and RHEL Advanced Virtualization are not affected by this bug, as the rocker device is not built and shipped with Red Hat qemu-kvm packages. Also, according to the QEMU upstream security guidelines [1] Red Hat Product Security does not consider this to be a vulnerability because it does not fall under the Virtualization Use Case; the rocker device is mainly used in development environments where the guest is assumed to be trusted.

[1] https://www.qemu.org/docs/master/system/security.html

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.