sd_wp_addr in hw/sd/sd.c in QEMU 4.2.0 uses an unvalidated address, which leads to an out-of-bounds read during sdhci_write() operations. A guest OS user can crash the QEMU process.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade qemu | Sep 15, 2020 | May 27, 2020 |
| Gentoo Linux | — | Upgrade app-emulation/qemu. | Nov 12, 2020 | May 27, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade qemu-img | Nov 3, 2020 | May 27, 2020 |
| Oracle_linux | — | Upgrade qemu-block-iscsiUpgrade qemu-commonUpgrade qemuUpgrade qemu-block-rbdUpgrade qemu-system-x86-coreUpgrade qemu-block-glusterUpgrade ivshmem-toolsUpgrade qemu-kvmUpgrade qemu-system-aarch64Upgrade qemu-system-x86Upgrade qemu-system-aarch64-coreUpgrade qemu-kvm-coreUpgrade qemu-img | Feb 9, 2021 | May 20, 2020 |
| Suse | — | Upgrade qemu-s390 | Jan 28, 2022 | May 27, 2020 |
| Ubuntu | — | Upgrade qemu-system-x86-microvmUpgrade qemu-system-aarch64Upgrade qemuUpgrade qemu-system-ppc (Ubuntu Pro)Upgrade qemu-system-ppcUpgrade qemu-system-sparcUpgrade qemu-system-armUpgrade qemu-system-x86-xenUpgrade qemu-system-mips (Ubuntu Pro)Upgrade qemu-system-mipsUpgrade qemu-system-sparc (Ubuntu Pro)Upgrade qemu-system-x86Upgrade qemu-systemUpgrade qemu-system-s390xUpgrade qemu-system-aarch64 (Ubuntu Pro)Upgrade qemu-system-x86 (Ubuntu Pro)Upgrade qemu-system-arm (Ubuntu Pro)Upgrade qemu (Ubuntu Pro)Upgrade qemu-system-misc (Ubuntu Pro)Upgrade qemu-system (Ubuntu Pro) | Aug 20, 2020 | May 27, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub