rom_copy() in hw/core/loader.c in QEMU 4.0 and 4.1.0 does not validate the relationship between two addresses, which allows attackers to trigger an invalid memory copy operation.
CVSS Details
- CVSS 3.1 Base Score: 5.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade qemu | Aug 22, 2024 | Jun 4, 2020 |
| Amazon Linux Ami 2 | — | Upgrade ivshmem-toolsUpgrade qemu-block-curlUpgrade qemu-ui-gtkUpgrade qemu-audio-alsaUpgrade qemu-userUpgrade qemu-guest-agentUpgrade qemu-block-sshUpgrade qemu-audio-paUpgrade qemu-commonUpgrade qemu-block-iscsiUpgrade qemuUpgrade qemu-system-aarch64-coreUpgrade qemu-block-rbdUpgrade qemu-system-x86-coreUpgrade qemu-kvmUpgrade qemu-block-nfsUpgrade qemu-ui-cursesUpgrade qemu-system-x86Upgrade qemu-ui-sdlUpgrade qemu-user-binfmtUpgrade qemu-system-aarch64Upgrade qemu-block-dmgUpgrade qemu-kvm-coreUpgrade qemu-debuginfoUpgrade qemu-audio-ossUpgrade qemu-user-staticUpgrade qemu-imgUpgrade qemu-audio-sdl | Mar 22, 2021 | Jun 4, 2020 |
| Amazon_linux | — | Upgrade qemu-kvm | Mar 20, 2021 | Jun 4, 2020 |
| Centos_linux | — | Upgrade qemu-kvmUpgrade qemu-kvm-debuginfoUpgrade qemu-kvm-commonUpgrade qemu-imgUpgrade qemu-kvm-tools | Feb 4, 2021 | Jun 4, 2020 |
| Debian | — | Upgrade qemu | Jul 2, 2020 | Jun 4, 2020 |
| Oracle_linux | — | Upgrade qemu-kvm-commonUpgrade qemu-kvm-toolsUpgrade qemu-imgUpgrade qemu-kvm | Feb 4, 2021 | May 12, 2020 |
| Redhat_linux | — | Upgrade qemu-kvm-commonUpgrade qemu-kvm-debuginfoUpgrade qemu-imgUpgrade qemu-kvmUpgrade qemu-kvm-toolsNo solution exists | Feb 4, 2021 | Jun 4, 2020 |
| Suse | — | Upgrade qemu-audio-paUpgrade qemu-s390Upgrade qemu-ui-cursesUpgrade qemu-ui-gtkUpgrade qemu-vgabiosUpgrade qemu-x86Upgrade qemu-kvmUpgrade qemu-sgabiosUpgrade qemu-audio-alsaUpgrade kvmUpgrade qemu-ppcUpgrade qemu-block-curlUpgrade qemu-audio-ossUpgrade qemu-block-sshUpgrade qemu-block-iscsiUpgrade qemu-ui-sdlUpgrade qemu-audio-sdlUpgrade qemuUpgrade qemu-ipxeUpgrade qemu-toolsUpgrade qemu-langUpgrade qemu-seabiosUpgrade qemu-block-rbdUpgrade qemu-guest-agentUpgrade qemu-arm | Apr 17, 2021 | Jun 4, 2020 |
| Ubuntu | — | Upgrade qemu-system-sparcUpgrade qemu-system-aarch64 (Ubuntu Pro)Upgrade qemu-system-common (Ubuntu Pro)Upgrade qemu-system-mips (Ubuntu Pro)Upgrade qemu-system-x86 (Ubuntu Pro)Upgrade qemu-system-x86Upgrade qemu-system-mipsUpgrade qemu-system-aarch64Upgrade qemu-system-sparc (Ubuntu Pro)Upgrade qemuUpgrade qemu-system-s390xUpgrade qemu-system-arm (Ubuntu Pro)Upgrade qemu-system-armUpgrade qemu-system (Ubuntu Pro)Upgrade qemu-system-ppcUpgrade qemu-systemUpgrade qemu-system-ppc (Ubuntu Pro)Upgrade qemu (Ubuntu Pro)Upgrade qemu-system-misc (Ubuntu Pro) | Aug 20, 2020 | Jun 4, 2020 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub