CVE-2022-36648

CRITICAL

The hardware emulation in the of_dpa_cmd_add_l2_flood of rocker device model in QEMU, as used in 7.0.0 and earlier, allows remote attackers to crash the host qemu and potentially execute code on th...

Affects 1 product across 1 vendor.

CVSS 3.110.0
EPSS1.7%
Percentile77th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, can impact systems beyond the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-476: NULL Pointer Dereference

Software attempts to use a NULL pointer, causing a crash and denial of service.

◆ AI Analysis — automated analysis, not human-reviewed

CVE-2022-36648 involves a potential vulnerability in the hardware emulation of the rocker device model in QEMU versions 7.0.0 and earlier, which could allow remote attackers to crash the host QEMU and potentially execute code on the host via a malformed program in the guest OS. However, this has been disputed by multiple third parties as not a valid vulnerability due to the rocker device not falling within the virtualization context.

BSID: BS-2023-GLOBAL-056440-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2022-36648?
CVE-2022-36648 involves a potential vulnerability in the hardware emulation of the rocker device model in QEMU versions 7.0.0 and earlier, which could allow remote attackers to crash the host QEMU and potentially execute code on the host via a malformed program in the guest OS. However, this has been disputed by multiple third parties as not a valid vulnerability due to the rocker device not falling within the virtualization context.
What is the CVSS score for CVE-2022-36648?
CVE-2022-36648 has CVSS 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS: 1.7%.
Is CVE-2022-36648 actively exploited?
No confirmed active exploitation of CVE-2022-36648 as of 2026-09-25.
How do I remediate CVE-2022-36648?
Priority: MEDIUM.
What systems are affected by CVE-2022-36648?
CVE-2022-36648 affects Qemu Qemu.
Vulnerability Details
CVE IDCVE-2022-36648
BSIDBS-2023-GLOBAL-056440-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Published2023-08-22
Last Modified2026-06-17
ICS Relevance0%
Weakness (CWE)
NULL Pointer Dereference
SourceNVD
Official Description

The hardware emulation in the of_dpa_cmd_add_l2_flood of rocker device model in QEMU, as used in 7.0.0 and earlier, allows remote attackers to crash the host qemu and potentially execute code on the host via execute a malformed program in the guest OS. Note: This has been disputed by multiple third parties as not a valid vulnerability due to the rocker device not falling within the virtualization use case.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The attack vector involves a remote attacker executing a malformed program in the guest OS, which could exploit the hardware emulation in the of_dpa_cmd_add_l2_flood function of the rocker device model in QEMU. This could lead to a denial of service (host QEMU crash) and potentially code execution on the host.

Exploitation Likelihood: MEDIUM

Affected Products
VendorProductAffected Versions
Qemu Qemu ≤ 7.0.0
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 1150 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceMEDIUM
Enriched At2026-05-24
SHA-512 Audit Hash68dcc929fa72ec085074c6c55d9138e7aa3e166238e316f8ac4011fff955bdaa10a6fba7dfb59958ba54ee76b25c367da2d383f7984ca31ff7ef16ded4ae6491
Related CVEs affecting Qemu
CVE-2017-16845 10.0 hw/input/ps2.c in Qemu does not validate 'rptr' and 'count' values during gue... CVE-2015-8556 10.0 Local privilege escalation vulnerability in the Gentoo QEMU package before 2.5.0-r1. CVE-2017-2620 9.9 Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator... CVE-2009-3616 9.9 Multiple use-after-free vulnerabilities in vnc.c in the VNC server in QEMU 0.... CVE-2016-9603 9.9 A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator...
View all Qemu CVEs →

Critical Severity - Know Your Exposure

A CVSS 10.0 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →