rom_copy() in hw/core/loader.c in QEMU 4.0 and 4.1.0 does not validate the relationship between two addresses, which allows attackers to trigger an invalid memory copy operation.
CVSS Details
- CVSS 3.1 Base Score: 5.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qemu | Aug 22, 2024 | Jun 4, 2020 |
| Amazon Linux Ami 2 | — | Upgrade qemu-commonUpgrade ivshmem-toolsUpgrade qemu-block-sshUpgrade qemuUpgrade qemu-system-x86-coreUpgrade qemu-system-aarch64-coreUpgrade qemu-audio-paUpgrade qemu-ui-gtkUpgrade qemu-block-iscsiUpgrade qemu-kvmUpgrade qemu-block-rbdUpgrade qemu-block-curlUpgrade qemu-guest-agentUpgrade qemu-audio-alsaUpgrade qemu-userUpgrade qemu-audio-ossUpgrade qemu-ui-sdlUpgrade qemu-user-binfmtUpgrade qemu-system-aarch64Upgrade qemu-user-staticUpgrade qemu-imgUpgrade qemu-block-dmgUpgrade qemu-kvm-coreUpgrade qemu-debuginfoUpgrade qemu-audio-sdlUpgrade qemu-system-x86Upgrade qemu-ui-cursesUpgrade qemu-block-nfs | Mar 22, 2021 | Jun 4, 2020 |
| Amazon_linux | — | Upgrade qemu-kvm | Mar 20, 2021 | Jun 4, 2020 |
| Centos_linux | — | Upgrade qemu-kvmUpgrade qemu-kvm-commonUpgrade qemu-kvm-debuginfoUpgrade qemu-imgUpgrade qemu-kvm-tools | Feb 4, 2021 | Jun 4, 2020 |
| Debian | — | Upgrade qemu | Jul 2, 2020 | Jun 4, 2020 |
| Oracle_linux | — | Upgrade qemu-kvm-toolsUpgrade qemu-kvm-commonUpgrade qemu-imgUpgrade qemu-kvm | Feb 4, 2021 | May 12, 2020 |
| Redhat_linux | — | Upgrade qemu-kvm-debuginfoUpgrade qemu-imgUpgrade qemu-kvm-commonNo solution existsUpgrade qemu-kvmUpgrade qemu-kvm-tools | Feb 4, 2021 | Jun 4, 2020 |
| Suse | — | Upgrade qemu-armUpgrade qemu-block-sshUpgrade qemu-audio-sdlUpgrade qemu-toolsUpgrade qemu-seabiosUpgrade qemu-ui-sdlUpgrade qemu-guest-agentUpgrade qemu-block-rbdUpgrade qemu-ipxeUpgrade qemuUpgrade qemu-block-iscsiUpgrade qemu-langUpgrade qemu-audio-ossUpgrade qemu-kvmUpgrade qemu-ui-cursesUpgrade qemu-audio-paUpgrade qemu-ui-gtkUpgrade qemu-s390Upgrade qemu-vgabiosUpgrade kvmUpgrade qemu-block-curlUpgrade qemu-sgabiosUpgrade qemu-ppcUpgrade qemu-x86Upgrade qemu-audio-alsa | Apr 17, 2021 | Jun 4, 2020 |
| Ubuntu | — | Upgrade qemu-system-x86Upgrade qemu-system-common (Ubuntu Pro)Upgrade qemu-system-mips (Ubuntu Pro)Upgrade qemu-system-aarch64 (Ubuntu Pro)Upgrade qemu-system-aarch64Upgrade qemu-system-x86 (Ubuntu Pro)Upgrade qemu-system-sparc (Ubuntu Pro)Upgrade qemu-system-mipsUpgrade qemu-system-sparcUpgrade qemu-system-ppc (Ubuntu Pro)Upgrade qemu-system-armUpgrade qemu-systemUpgrade qemu-system-ppcUpgrade qemu-system-misc (Ubuntu Pro)Upgrade qemuUpgrade qemu (Ubuntu Pro)Upgrade qemu-system-arm (Ubuntu Pro)Upgrade qemu-system-s390xUpgrade qemu-system (Ubuntu Pro) | Aug 20, 2020 | Jun 4, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub