sd_wp_addr in hw/sd/sd.c in QEMU 4.2.0 uses an unvalidated address, which leads to an out-of-bounds read during sdhci_write() operations. A guest OS user can crash the QEMU process.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu | Sep 15, 2020 | May 27, 2020 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Nov 12, 2020 | May 27, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade qemu-img | Nov 3, 2020 | May 27, 2020 |
| Oracle_linux | — | Upgrade qemu-kvm-coreUpgrade qemu-imgUpgrade qemu-system-aarch64Upgrade qemu-system-aarch64-coreUpgrade qemu-system-x86Upgrade qemuUpgrade qemu-block-rbdUpgrade qemu-commonUpgrade qemu-kvmUpgrade qemu-block-glusterUpgrade ivshmem-toolsUpgrade qemu-block-iscsiUpgrade qemu-system-x86-core | Feb 9, 2021 | May 20, 2020 |
| Suse | — | Upgrade qemu-s390 | Jan 28, 2022 | May 27, 2020 |
| Ubuntu | — | Upgrade qemu-system-sparc (Ubuntu Pro)Upgrade qemu (Ubuntu Pro)Upgrade qemu-system-mipsUpgrade qemu-system (Ubuntu Pro)Upgrade qemu-system-misc (Ubuntu Pro)Upgrade qemu-system-x86Upgrade qemu-system-arm (Ubuntu Pro)Upgrade qemu-system-x86 (Ubuntu Pro)Upgrade qemu-system-aarch64 (Ubuntu Pro)Upgrade qemu-system-mips (Ubuntu Pro)Upgrade qemu-systemUpgrade qemu-system-s390xUpgrade qemu-system-aarch64Upgrade qemu-system-ppcUpgrade qemu-system-armUpgrade qemu-system-ppc (Ubuntu Pro)Upgrade qemu-system-x86-microvmUpgrade qemu-system-sparcUpgrade qemu-system-x86-xenUpgrade qemu | Aug 20, 2020 | May 27, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub