sd_wp_addr in hw/sd/sd.c in QEMU 4.2.0 uses an unvalidated address, which leads to an out-of-bounds read during sdhci_write() operations. A guest OS user can crash the QEMU process.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu | Sep 15, 2020 | May 27, 2020 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Nov 12, 2020 | May 27, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade qemu-img | Nov 3, 2020 | May 27, 2020 |
| Oracle_linux | — | Upgrade qemu-system-aarch64-coreUpgrade qemu-imgUpgrade qemu-kvm-coreUpgrade qemu-system-x86Upgrade qemu-system-aarch64Upgrade ivshmem-toolsUpgrade qemuUpgrade qemu-commonUpgrade qemu-block-glusterUpgrade qemu-kvmUpgrade qemu-block-rbdUpgrade qemu-block-iscsiUpgrade qemu-system-x86-core | Feb 9, 2021 | May 20, 2020 |
| Suse | — | Upgrade qemu-s390 | Jan 28, 2022 | May 27, 2020 |
| Ubuntu | — | Upgrade qemu-system-mips (Ubuntu Pro)Upgrade qemu-system-mipsUpgrade qemu-systemUpgrade qemu-system-arm (Ubuntu Pro)Upgrade qemu-system (Ubuntu Pro)Upgrade qemu-system-misc (Ubuntu Pro)Upgrade qemu (Ubuntu Pro)Upgrade qemu-system-aarch64 (Ubuntu Pro)Upgrade qemu-system-x86Upgrade qemu-system-sparc (Ubuntu Pro)Upgrade qemu-system-s390xUpgrade qemu-system-x86 (Ubuntu Pro)Upgrade qemu-system-sparcUpgrade qemu-system-x86-xenUpgrade qemu-system-aarch64Upgrade qemuUpgrade qemu-system-x86-microvmUpgrade qemu-system-ppcUpgrade qemu-system-armUpgrade qemu-system-ppc (Ubuntu Pro) | Aug 20, 2020 | May 27, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub