In QEMU 5.0.0 and earlier, es1370_transfer_audio in hw/audio/es1370.c does not properly validate the frame count, which allows guest OS users to trigger an out-of-bounds access during an es1370_write() operation.
CVSS Details
- CVSS 3.1 Base Score: 3.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qemu | Aug 22, 2024 | May 28, 2020 |
| Debian | — | Upgrade qemu | Jul 2, 2020 | May 28, 2020 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Nov 12, 2020 | May 28, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade qemu-img | Nov 3, 2020 | May 28, 2020 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 28, 2020 |
| Suse | — | Upgrade qemu-ipxeUpgrade qemu-hw-display-virtio-gpu-pciUpgrade qemu-chardev-spiceUpgrade qemu-audio-ossUpgrade qemu-linux-userUpgrade qemu-hw-display-virtio-gpuUpgrade qemu-block-sshUpgrade kvmUpgrade qemu-sgabiosUpgrade qemu-armUpgrade qemu-toolsUpgrade qemu-ui-spice-appUpgrade qemu-audio-paUpgrade qemu-ui-sdlUpgrade qemu-guest-agentUpgrade qemu-ppcUpgrade qemu-hw-display-qxlUpgrade qemu-skibootUpgrade qemu-ui-openglUpgrade qemu-ui-cursesUpgrade qemuUpgrade qemu-block-nfsUpgrade qemu-block-glusterUpgrade qemu-hw-display-virtio-vgaUpgrade qemu-hw-usb-redirectUpgrade qemu-seabiosUpgrade qemu-audio-spiceUpgrade qemu-vhost-user-gpuUpgrade qemu-langUpgrade qemu-block-iscsiUpgrade qemu-block-dmgUpgrade qemu-microvmUpgrade qemu-s390Upgrade qemu-audio-sdlUpgrade qemu-s390xUpgrade qemu-hw-s390x-virtio-gpu-ccwUpgrade qemu-audio-alsaUpgrade qemu-extraUpgrade qemu-ui-spice-coreUpgrade qemu-chardev-baumUpgrade qemu-kvmUpgrade qemu-block-rbdUpgrade qemu-block-curlUpgrade qemu-ui-gtkUpgrade qemu-ksmUpgrade qemu-testsuiteUpgrade qemu-x86Upgrade qemu-vgabios | Jul 29, 2020 | May 28, 2020 |
| Ubuntu | — | Upgrade qemu (Ubuntu Pro)Upgrade qemu-system-x86-microvmUpgrade qemu-system-x86-xenUpgrade qemu-system-s390xUpgrade qemu-system-armUpgrade qemu-system-ppc (Ubuntu Pro)Upgrade qemu-system-arm (Ubuntu Pro)Upgrade qemu-system-sparc (Ubuntu Pro)Upgrade qemu-system-mipsUpgrade qemuUpgrade qemu-system-x86Upgrade qemu-system (Ubuntu Pro)Upgrade qemu-system-aarch64Upgrade qemu-system-misc (Ubuntu Pro)Upgrade qemu-system-aarch64 (Ubuntu Pro)Upgrade qemu-system-sparcUpgrade qemu-system-mips (Ubuntu Pro)Upgrade qemu-system-x86 (Ubuntu Pro)Upgrade qemu-systemUpgrade qemu-system-ppc | Aug 20, 2020 | May 28, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub